Mathematics and Computation

Home , Alistair Sinclair, Avi Wigderson, Salil Vadhan, Sanjeev Arora, The Queries, Tim Roughgarden

Avi Wigderson March 27, 2018

1 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Dedicated to the memory of my father, Pinchas Wigderson (1921–1988), who loved people, loved puzzles, and inspired me.

Ashkhabad, Turkmenistan, 1943

2 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Acknowledgments

In this book I tried to present some of the knowledge and understanding I acquired in my four decades in the field. The main source of this knowledge was the Theory of Computation community, which has been my academic and social home throughout this period. The members of this wonderful community, especially my teachers, students, postdocs and collaborators, but also the speakers in numerous talks I attended, have been the source of this knowledge and understanding often far more than the books and journals I read. Ours is a generous and interactive community, whose members are happy to share their own knowledge and understanding with others, and are trained by the culture of the field to do so well. These interactions made (and still makes) learning a greatly joyful experience for me! More directly, the content and presentation in this book benefited directly by many. These are friends who carefully read earlier drafts, responded with valuable constructive comments at all levels, which made the book much better. For this I am grateful to Scott Aaronson, Dorit Aharonov, Noga Alon, Sanjeev Arora, Boaz Barak, Zeb Brady, Mark Braverman, Bernard Chazelle, Tom Church, Geoffroy Couteau, Andy Drucker, Ron Fagin, Yuval Filmus, Michael Forbes, Ankit Garg, Sumegha Garg, Oded Goldreich, Renan Gross, Nadia Heninger, Gil Kalai, Vickie Kearn, Pravesh Kothari, James Lee, Alex Lubotzky, Assaf Naor, Ryan O’Donnell, Toni Pitassi, Tim Roughgarden, Sasha Razborov, Mike Saks, Peter Sarnak, Susannah Shoemaker, Amir Shpilka, Alistair Sinclair, Bill Steiger, Arpita Tripathi, Salil Vadhan, Les Valiant, Thomas Vidick, BenLee Volk, Edna Wigderson, Yuval Wigderson, Ronald de Wolf, Amir Yehudayoff, Rich Zemel and David Zuckerman. Special additional thanks are due to Edna and Yuval, who not only read every word (several times), but also helped me overcome many technical problems with the manuscript. Some chapters in this book are revisions and extensions of material taken from my ICM 2006 survey [Wig06], which in turn used parts of a joint survey with Goldreich in this volume [GBGL10]. Last but not least, I am grateful to Tom and Roselyne Nelsen for letting me use their beautiful home in Sun Valley, Idaho - much of this book was written in that serene environment over the past few summers.

3 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Contents

1 Introduction 9 1.1 On the interactions of math and computation...... 10 1.2 Computational Complexity Theory...... 13 1.3 The nature, purpose, style and audience of the book...... 14 1.4 Organization of the book...... 15 1.5 Asymptotic Notation...... 19

2 Prelude: computation, undecidability and the limits of mathematical knowledge 20

3 Computational complexity 101: the basics 24 3.1 Motivating examples...... 24 3.2 Efficient computation and the class P ...... 26 3.3 Efficient verification and the class NP ...... 30 3.4 The P versus NP question, its meaning and importance...... 34 3.5 The class coNP, the NP versus coNP question, and efficient characterization... 37 3.6 Reductions: a partial order of computational difficulty...... 40 3.7 Completeness: problems capturing complexity classes...... 41 3.8 NP-completeness...... 42 3.9 Some NP-complete problems...... 43 3.10 The nature and impact of NP-completeness...... 45

4 Problems and classes inside (and “around”) NP 48 4.1 Other types of computational problems and associated complexity classes...... 48 4.2 Between P and NP ...... 50 4.3 Constraint Satisfaction Problems (CSPs)...... 53 4.4 Average-case complexity...... 55 4.5 One-way functions, trap-door functions and cryptography...... 56

5 Lower bounds, Boolean Circuits, and attacks on P vs. NP 61 5.1 Diagonalization and relativization...... 61 5.2 Boolean circuits...... 62 5.2.1 Basic results and questions...... 64 5.2.2 Boolean formulae...... 65 5.2.3 Monotone circuits and formulae...... 67 5.2.4 Natural Proofs, or, Why is it hard to prove circuit lower bounds?...... 69

6 Proof complexity 71 6.1 The pigeonhole principle—a motivating example...... 73 6.2 Propositional proof systems and NP vs. coNP ...... 74 6.3 Concrete proof systems...... 76 6.3.1 Algebraic proof systems...... 76 6.3.2 Geometric proof systems...... 78 6.3.3 Logical proof systems...... 81 6.4 Proof complexity vs. circuit complexity...... 83

4 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

7 Randomness in computation 86 7.1 The power of randomness in algorithms...... 86 7.2 The weakness of randomness in algorithms...... 89 7.3 Computational pseudo-randomness and pseudo-random generators...... 92

8 Abstract pseudo-randomness 100 8.1 Motivating examples...... 100 8.2 General pseudo-random properties, and ﬁnding hay in haystacks...... 101 8.3 The Riemann Hypothesis...... 103 8.4 P vs. NP ...... 104 8.5 Computational pseudo-randomness and de-randomization...... 106 8.6 Quasi-random graphs...... 108 8.7 Expanders...... 109 8.8 Structure vs. Pseudo-randomness...... 113

9 Weak random sources and randomness extractors 117 9.1 Min-entropy and randomness extractors...... 118 9.2 Explicit constructions of extractors...... 120

10 Randomness in proofs 123 10.1 Interactive proof systems...... 124 10.2 Zero-knowledge proof systems...... 127 10.3 Probabilistically checkable proofs (and hardness of approximation)...... 129

11 Quantum Computing 132 11.1 Building a quantum computer...... 135 11.2 Quantum proofs and quantum Hamiltonian complexity and dynamics...... 136 11.3 Quantum interactive proofs and testing Quantum Mechanics...... 140 11.4 Quantum randomness: certiﬁcation and expansion...... 141

12 Arithmetic complexity 144 12.1 Motivation: univariate polynomials...... 144 12.2 Basic deﬁnitions, questions and results...... 145 12.3 The complexity of basic polynomials...... 146 12.4 Reductions and completeness, permanents and determinants...... 151 12.5 Restricted models...... 153

13 Interlude: Concrete interactions between Math and Computational Complexity156 13.1 Number Theory...... 156 13.2 Combinatorial geometry...... 158 13.3 Operator theory...... 159 13.4 Metric Geometry...... 161 13.5 Group Theory...... 162 13.6 Statistical Physics...... 164 13.7 Analysis and Probability...... 166 13.8 Lattice Theory...... 169 13.9 Invariant Theory...... 171

5 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

13.9.1 Geometric Complexity Theory (GCT)...... 173 13.9.2 Simultaneous Conjugation...... 174 13.9.3 Left-Right action...... 175

14 Space complexity: modeling limited memory 177 14.1 Basic space complexity...... 177 14.2 Streaming and Sketching...... 180 14.3 Finite automata and counting...... 181

15 Communication complexity: modeling information bottlenecks 185 15.1 Basic definitions and results...... 185 15.2 Applications...... 188 15.2.1 VLSI time-area trade-offs...... 188 15.2.2 Time-space trade-offs...... 189 15.2.3 Formula lower bounds...... 190 15.2.4 Proof complexity...... 193 15.2.5 Extension complexity...... 194 15.2.6 Pseudo-randomness...... 197 15.3 Interactive information theory and coding theory...... 198 15.3.1 Information complexity, protocol compression and direct-sum...... 199 15.3.2 Error-correction of interactive communication...... 202

16 On-line algorithms: coping with an unknown future 206 16.1 Paging, Caching and the k-server problem...... 208 16.2 Expert advice, portfolio management, repeated games and the multiplicative weights algorithm...... 209

17 Computational learning theory, AI and beyond 213 17.1 Classifying hyperplanes—a motivating example...... 214 17.2 Classification/Identification—some choices and modeling issues...... 216 17.3 Identification in the limit—the linguistic/recursion theoretic approach...... 218 17.4 Probably, Approximately Correct (PAC) learning—the statistical approach..... 221 17.4.1 Basics of the PAC framework...... 222 17.4.2 Efficiency and optimization...... 225 17.4.3 Agnostic PAC learning...... 226 17.4.4 Compression and Occam’s razor...... 226 17.4.5 Boosting: making weak learners strong...... 227 17.4.6 The hardness of PAC learning (and in particular, of DNFs)...... 230

18 Cryptography: modeling secrets and lies, knowledge and trust 233 18.1 The ambitions of modern cryptography...... 233 18.2 Information theory vs. Complexity theory: Take 1...... 234 18.3 The axioms of modern, complexity-based cryptography...... 235 18.4 Cryptographic deﬁnitions...... 236 18.5 Probabilistic encryption...... 238 18.6 Basic paradigms for security deﬁnitions: simulation and ideal functionality...... 239 18.7 Secure Multi-Party Computation (SMC)...... 243

6 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

18.8 Information theory vs. Complexity theory: Take 2...... 246 18.9 More recent advances...... 247 18.10Physical attacks...... 250 18.11The complexity of factoring...... 251

19 Distributed computing: coping with asynchrony 252 19.1 High-level modeling issues...... 253 19.2 Sharing resources and the dining philosophers problem...... 255 19.3 Coordination: consensus and Byzantine generals...... 257 19.4 Renaming, k-set agreement and beyond...... 260 19.5 Local synchronous coloring...... 266

20 Epilogue: a broader perspective of ToC 269 20.1 Close collaborations and interactions...... 270 20.1.1 Computer Science and Engineering...... 270 20.1.2 Mathematics...... 271 20.1.3 Optimization...... 272 20.1.4 Coding and Information Theory...... 273 20.1.5 Statistical Physics...... 274 20.2 What is computation?...... 276 20.3 ToC Methodology...... 278 20.4 The computational complexity lens on the sciences...... 281 20.4.1 Molecular Biology...... 284 20.4.2 Ecology and Evolution...... 285 20.4.3 Neuroscience...... 287 20.4.4 Quantum Physics...... 288 20.4.5 Economics...... 290 20.4.6 Social Science...... 293 20.5 Conceptual contributions; or, algorithms and philosophy...... 294 20.6 Algorithms and Technology...... 296 20.6.1 Algorithmic heroes...... 296 20.6.2 Algorithms and Moore’s Law...... 297 20.6.3 Algorithmic gems vs. Deep Nets...... 298 20.7 Some important challenges of ToC...... 299 20.7.1 Certifying intractability...... 299 20.7.2 Understanding heuristics...... 300 20.7.3 Resting cryptography on stronger foundations...... 302 20.7.4 Exploring physical reality vs. computational complexity...... 303 20.8 K-12 Education...... 305 20.9 The ToC community...... 307 20.10Conclusions...... 311

7 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

List of Figures

1 Instances of problem (2) and their classification. The left is a diagram of the “Trefoil knot” and the right of the “Unknot”...... 20 2 Instances of problem (3) and their classification. Both maps are 4-colorable...... 21 3 A graph with a perfect matching (shown) and one without a perfect matching.... 29 4 Two linear programs with 2 variables and 3 inequalities...... 29 5 Which of these graphs are Hamiltonian? Which pairs of these graphs are isomorphic? 32 6 P, NP, and coNP ...... 39 7 A schematic illustration of a reduction between two classification problems..... 41 8 Composing a reduction and an algorithm to create a new algorithm...... 41 9 The gadget underlying the reduction from SAT to 3-COL...... 45 10 Between P and PSPACE. As far as we know, all these classes may be equal!.... 51 11 A circuit computing parity on 4 bits...... 63 12 A formula computing parity on 4 bits...... 66 13 The contradiction φ ...... 76 14 A tree-like Polynomial Calculus refutation of φ ...... 78 15 A tree-like Cutting Planes refutation of φ ...... 79 16 A tree-like Resolution refutation of φ ...... 83 17 Schematic of a pseudo-random distribution Dn -fooling a circuit C...... 90 18 Schematic of a pseudo-random generator G -fooling a circuit C...... 91 19 Schematic of NWf . Essentially, the n outputs are obtained by applying f to n different subsequences (with small pairwise overlaps) of the m-bit long input sequence. 97 20 Dining philosophers’ table...... 255 21 Triangulation and Sperner coloring. Rainbow triangles are shaded. (Source: Wikipedia)262 22 Basic “triangulation”, i.e. D1...... 264 23 Cube and tetrahedron from DNA strands, from Ned Seeman’s lab...... 284 24 Search “starling murmurings” for amazing videos!...... 286

8 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

“P versus NP — a gift to mathematics from computer science” Steve Smale

1 Introduction

Here is just one tip of the iceberg we’ll explore. How much time does it take to find the prime factors of a 1000-digit integer? The facts are that (1) we can’t even roughly estimate for the answer; it can be less than a second or more than a million years, and (2) practically all electronic commerce and Internet security systems in existence today rest on the belief that it takes more than a million years! Digesting even this one specific example begins to illuminate the conceptual revolution of computational complexity theory, to which this book is devoted. It illustrates how a pure number theoretic problem, that was studied for millennia by mathematicians, becomes a cornerstone of a trillion dollar industry that practically all people, companies and countries on earth crucially depend on. Extracting this novel meaning and utility relies on making the problem above precise, and on transforming the informal statement of (2) into a mathematical theorem. This in turn requires formal definitions of such concepts as algorithm, efficiency, secret, randomness and many others, including several new notions of proof. The difficulty of resolving (the now all-important) challenge (1), namely testing the strength of the hardness assumption of (2) or suggesting alternatives to it, is intimately related to the great conundrum of P vs. NP. And as a final twist in this plot, a fork appeared in our computational path, by which the answer to (1) may radically depend on whether we allow classical or quantum physics to power our computers. This new possibility propelled huge investments in academia and industry to attempt and physically realize the potential of quantum computers. It also demands revisiting and redefining the very concepts above, as well as many physical ones like entanglement and decoherence, interacting with quantum mechanics and proposing novel ways of testing its foundations. The book you are reading will explore this intellectual goldmine! It will exposit computational complexity theory, the concepts it created and revolutionized, and its many connections and interactions with mathematics. In its half-century of existence it has developed into a rich, deep and broad mathematical theory with remarkable achievements and formidable challenges. It had forged strong connections with most other mathematical fields, and at the same time had major practical impact on computer science and industry. Computational complexity theory is a central subfield of the Theory of Computation (ToC), with a pivotal role in its evolution. We have devoted the final chapter of this book (which can be read first) to a panoramic overview of ToC. It exposits the intellectual supernova that the theory of computing has created and continues to shape, discussing the broad reaches of ToC to all sciences, technology and society, and discusses its methodology, challenges and unique position in the intellectual sphere. Below we review the long history of interactions of computation and mathematics. We proceed with a short overview of the evolution and nature of computational complexity. We then turn describe the structure, scope and intended audiences of this book, followed by a detailed description of its chapters.

9 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

1.1 On the interactions of math and computation The Theory of Computation is the study of the formal foundations of computer science and technology. This dynamic and rapidly expanding field straddles mathematics and computer science. It has benefitted tremendously from the very different characters, motivations and traditions of these parent disciplines. Both sides naturally emerged from its birth, in the “big bang” of Turing’s seminal 1936 paper [Tur36], “On computable numbers, with an application to the Entscheidungsproblem”. One has to remember that this is a paper which was written by a PhD student, in the area of mathematical logic, that combined with its long title might seem condemned to obscurity. How- ever, with Turing’s incredible clarity of vision, exposition and motivation, it is an inspiring model in mathematical modeling with singular impact. This paper formally defined an algorithm in the form of what we call today the “Turing machine”. On the one hand, the Turing machine is a formal, mathematical model of computation, enabling for the first time the rigorous definition of computational tasks, the algorithms to solve them, and the basic resources these require (in particular, allowing Turing to prove that very basic tasks are uncomputable!). On the other hand, the extremely elegant definition of the Turing machine allowed its simple, logical design to be readily implemented in hardware and software, igniting the computer revolution. These theoretical and practical sides form the dual nature of ToC and strongly influenced the field and its evolution. On the mathematical side, the abstract notion of computation revealed itself as an extremely deep and mysterious notion, which illuminates other, often well studied concepts with a new light. In pursuing the abstract study of computation ToC progresses like any other mathematical field. Its researchers prove theorems, and follow mathematical culture to generalize, simplify and create variations, following their noses based on esthetics and beauty. From the practical side, the universal applicability of automated computation fueled the rapid development of computer technology, which now dominates our life. The interaction between the theory and practice never stops. The evolving world of computer science and industry continuously creates new types and properties of computation which need theoretical modeling and understanding, and directly impacts the mathematical evolution of ToC, while ideas, models and techniques generated there feed back into the practical world. Besides technology, a more recent and growing source of external influence on ToC are nature and science. Many natural processes can (and should) be understood as information processes, and beg similar computational understanding. Again here, theoretical modeling, techniques and new theoretical questions feed back to suggest experiments and better understanding of scientific data. Much more on these connections is discussed in Chapter 20. Needless to say, mathematics and computation did not meet in 1936 for the first time; they have been tied to each other from the dawn of man. Indeed, ancient mathematics developed primarily from the need to compute, be it in predictions of natural phenomena of all types, management of crops and livestock, manufacturing and building, trading commodities and planning for the future. Devising representations of numbers, and efficient methods for performing arithmetic on them were thus central. More generally, in a very fundamental way, a mathematical understanding could solve any practical problem only through a computational process applied to the data at hand. So, while algorithms were formally defined only in the 20th century, mathematicians and scientists continuously devised, described, and used better and better algorithms (albeit informally explained and rarely analyzed) for the computations required to draw conclusions from their theories. Examples abound, and we list just a few highlights. Euclid, working around 300 BCE, devised his fast GCD1

1The GCD (Greatest Common Division) problem, is to compute the largest integer evenly dividing two other integers.

10 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

algorithm to bypass the need to laboriously factor integers when simplifying fractions. Euclid’s famous 13-volume Elements, the central math text for many centuries, contain dozens of other algorithms to compute numerical and geometric quantities and structures. In the same era Chinese mathematicians compiled The Nine Chapters on the Mathematical Art, containing many computational methods including “Gaussian elimination” (for solving systems of linear equations). In the 9th century al-Khw¯arizm¯ı(after whom algorithm is named!) wrote his books Compendious Book on Calculation by Completion and Balancing and On the Hindu Art of Reckoning. These books respectively exposit everything known till that time about algorithms for algebraic and arithmetic problems, like solving quadratic equations and linear systems, and performing arithmetic operations in the decimal system. It is a crucial observation to make, that the very reason that the decimal system survived as the dominant way to represent numbers is these efficient algorithms for performing arithmetic on arbitrarily large numbers so represented. The “modern era” has intensified these connections between math and computation. Again, there are numerous examples. During the Renaissance, mathematicians found formulas, the most basic computational recipe, for solving cubic and quartic equations via radicals2. Indeed, famous competitions between Tartaglia, Piore, Ferrari and others in the early 1500s were all about who had a faster algorithm for solving cubic equations. The Abel-Ruffini theorem that the quintic equation has no such formula is perhaps the earliest hardness result: it proves the non-existence of an algorithm for a concrete problem, in a precise computational model. Newton’s Principia Mathematica is a masterpiece not only of grand scientific and mathematical theories; it is also a masterpiece of algorithms for computing the predictions of these theories. Perhaps the most famous and most general is “Newton’s method” for approximating the roots of real polynomials of arbitrary degree (practically bypassing the Abel-Ruffini obstacle above). The same can be said about Gauss’ magnum opus, Disquisitiones Arithmeticae—it is full of algorithms and computational methods. One famous example (published after his death), is his discovery3 of the “fast Fourier transform” (FFT), the central algorithm of signal processing, some 150 years before its “official” discovery by Cooley and Tukey. Aiming beyond concrete problems, Leibniz, Babbage, Lovelace and others pioneered explicit attempts to design, build and program general-purpose computational devices. Finally, Hilbert dreamed of resting all of mathematics on computational foundations, seeking a “mechanical procedure” which will (in principle) determine all mathematical truths. He believed that truth and proof coincide (namely that every true statement has a valid proof), and that such proofs can be found automatically by such a computational procedure. The quest to formalize Hilbert’s program within mathematical logic led directly to the works of Gödel,Church, Post and Turing. Their work shattered Hilbert’s dreams (proving them unattainable), but to do so it gave birth to formal definitions of computation and algorithms. Once these theoretical foundations were laid, the computer revolution arrived. The birth of computer science, and with it, the theory of computation, steadily enhanced, deepened and diversified the interactions between mathematics and computation, which in the last few decades have been growing explosively. These interactions can be roughly divided into four (naturally overlapping) categories. The first two categories arise from one field using the expertise developed by the other; these interactions are often mainly one-directional. The next two categories are more complex and are very much interactive. We will see many of them in action throughout the book. 2Namely, using arithmetic operations and taking roots. 3For the purposes of efficiently predicting the orbits of certain asteroids.

11 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• One type of interaction arises from the need of ToC to use general mathematical techniques and results. Initially these sources were restricted to areas having a natural affinity with computer science, like logic and discrete mathematics. However, as ToC developed, getting deeper and broader, it needed to import techniques and results from diverse mathematical areas, sometimes quite unexpectedly. Such examples include the use of analytic and geometric techniques for understanding approximation algorithms, the use of topological methods for studying distributed systems, and the use of number theory and algebraic geometry in constructions of pseudo-random objects. • The opposite type of interaction is the need of mathematics to use algorithms (and computers). As mentioned, mathematicians needed algorithms and developed them for centuries. But after Turing ToC made algorithm design into a comprehensive theory, ready to be used and applied, with general techniques for maintaining and manipulating information of all types, and methods for comparing the qualities and analyzing the resources of these algorithms. At the same time, computers became available. This confluence gave rise to a huge boom in developing specific algorithms and software for mathematicians in almost every field, with libraries of computational tools for algebra, topology, group theory, geometry, statistics and more. On a different front, there is a growing development and use of computer programs for mathematical proof verification, as well as proof discovery. • A deeper, fundamental source of interaction is the vast number of mathematical theorems which guarantee the existence of some mathematical object. It is by now a reflexive reaction to wonder: can the object guaranteed to exist be efficiently found? In many cases, some mentioned above, there are good practical reasons to seek such procedures. On a more philosophical level, non-constructive existence proofs (like Hilbert’s first proof of the finite basis theorem, and Cantor’s proof that most real numbers are not algebraic) appalled members of the mathematics community. Even in finite settings, existence proofs beg better understanding despite the availability of brute-force (but highly inefficient) search for the required object. We have mounting evidence, in diverse areas of math, that even without any direct, practical need or philosophical desire for such efficient algorithms, seeking them anyway invariably leads to a deeper understanding of the mathematical field at hand. This quest raises new questions and uncover new structures, sometimes reviving “well-understood” subjects. • The final source of interaction arises from the fact that the study of computation surprisingly led to the production of new mathematical results, theories and problems, which are not algorithmic, but rather structural in nature. These naturally arise both from the need to analyze algorithms and to prove hardness results. Thus were born completely new probabilistic concentration results, geometric incidence theorems, combinatorial regularity lemmas, isoperimetric inequalities, algebraic identities, statistical tests and more. These inspired collaboration with many mathematical areas, which in some cases is already quite established and in others only budding.

Mathematics and computation are linked in numerous strong bonds. This rich fabric of interactions manifests itself most strongly within the ﬁeld of computational complexity.

12 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

1.2 Computational Complexity Theory Early decades of research in the Theory of computation have centered on understanding which computational problems can, and which problems cannot be solved by algorithms. But it quickly became evident that this dividing line is too coarse; many problems that can be solved in principle remain intractable, as the best algorithms to solve them will terminate long after anyone cared or lived to see the answer. This created a need for a much finer theory, that will account for the performance of different algorithms. Thus was born computational complexity theory in the 1960s, with the initial charge of understanding efficient computation in the most general sense: what are the minimal amounts of natural resources, like time, memory, communication and others, needed to solve natural computational tasks by natural computational models. Responding to this charge, this theory developed a powerful toolkit of algorithmic techniques and ways to analyze them, as well as a classification system of computational problems in complexity classes. These also led to the formulation of natural long-term goals for the field regarding the power and limits of efficient computation. But this turned out to be only half of the story, as the resources consumed by algorithms are only the very basic properties of computation, and the utility of algorithms in different contexts presented other properties to explore. With time, and with such a variety internal and external motivations, computational complexity theory has greatly expanded its goals. It took on the computational modeling and the understanding of a variety of central notions, some studied for centuries by great minds, including secret, proof, learning, knowledge, randomness, interaction, evolution, game, strategy, coordination, synchrony and others. This computational lens often resulted in completely new meanings of these old concepts4. Moreover, in some of these cases the resulting theories predated, and indeed enabled, significant technological advances5. In other cases these theories formed the basis of interactions with other sciences. Thus, starting with the goal of understanding what can be efficiently computed, a host of natural long-term goals of deep conceptual meaning emerged. What can be efficiently learned? What can be efficiently proved? Is verifying a proof much easier than finding one? What does a machine know? What is the power of randomness in algorithms? Can we effectively use natural sources of randomness? What is the power of quantum mechanical computers? Can we utilize quantum phenomena in algorithms? In settings where different computational entities have different (possibly conflicting) incentives, what can be achieved jointly? Privately? Can computers efficiently simulate nature, or the brain? The study of efficient computation has created a powerful methodology with which to investigate such questions. Here are some of its important principles, which we will see in action repeatedly, and whose meaning will become clearer, in the chapters of this book. Computational modeling: uncover the underlying basic operations, information flow and resources of processes. Efficiency: attempt to minimize resources used and their trade-offs. Asymptotic thinking: study problems on larger and larger objects, as structure often reveals itself in the limit. Adversarial thinking: always prepare for the worst, replacing specific and structural restrictions by general, computational ones—such more stringent demands often make things simpler to understand! Classification: organize problems into

4For one example, in suggests that in proofs, one can decouple veriﬁcation and understanding: every mathematical theorem can be proved in a convincing manner which nonetheless reveals absolutely no information except its validity! (This will be discussed in Section 10.2.) 5The best example is cryptography, which in the 1980s was purely motivated by a collection of fun intellectual challenges like playing Poker over the telephone, but developed into a theory which enabled the explosive growth of the Internet and e-commerce. (This will be discussed in Chapter 18.)

13 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

(complexity) classes according to the resources they require. Reductions: ignore ignorance, and even if you can’t efficiently solve a problem, assume that you can, and explore which other problems it would help solve efficiently. Completeness: identify the most difficult problems in a complexity class6. Barriers: when stuck for a long time on a major question, abstract all known techniques used for it so far, and try to formally argue that they will not suffice for its resolution. These principles work extremely well with each other, and in surprisingly diverse settings, especially when applied at the right level of abstraction (which I believe was indeed cleverly chosen, repeatedly). This methodology allowed ToC to uncover hidden connections between different fields, and create a beautiful edifice of structure, a remarkable order in a vast collection of notions, problems, models, resources and motivations. While many of these principles are in use throughout mathematics and science, I believe that the disciplined, systematic use which has become ingrained in the culture of computational complexity, especially of problem classification via (appropriate) reductions and completeness, has a great potential to further enhance other academic fields. Computational complexity is extremely active and dynamic. While I have attempted to describe, besides the fundamentals, also some of the most recent advances in most areas, I expect the state- of-art will continue to expand quickly. Thus, some of the open problems will become theorems, new research directions will be created and new open problems will emerge. Indeed, this has happened repeatedly in the few years it took to write this book.

1.3 The nature, purpose and style of the book Computational complexity theory has been my intellectual (and social) home for almost 40 years. Over this period, I have written survey articles and have given many more survey lectures on various aspects of of this field. This book grew out of this collection, and out of the many other aspects I planned to write and talk about, but never got to. Indeed, breadth of scope is an important goal of the book. Further, as in my lectures and surveys, so in this book, I try to explain not only what we do, but why we do it, why is it so important, and why is it so much fun! The book exposits the foundations and some of the main research directions of computational complexity theory, and their many interactions with other branches of mathematics. The diversity of these computational settings is revealed when we next discuss the contents of every chapter below. For every research area, it focuses on the main aspects it attempts to model. It presents the notions, goals, results and open problems for each in turn, all from a conceptual perspective, trying to provide ample motivation and intuition. It attempts to describe the history and evolution of ideas leading to different notions and results, and their meaning and utility. It also highlights the rich tapestry of (often surprising and unexpected) connections between the different subareas of computational complexity theory; this unity of the field is an important part of its success. To highlight the conceptual perspective, the material is generally presented at a high level and somewhat informal fashion. Almost no proofs are given, and we focus on discussions of general proof techniques or key ideas, again, at an informal level. Precise definitions, theorem statements and of course detailed proofs for many topics discussed can be found in the excellent textbooks on computational complexity [Pap03,Gol08,AB09,MM11]. Also, for historical reasons and greater detail, we provide many references to some original papers, as well of more specialized textbooks and survey articles in every chapter.

6Namely those which all other problems in the class reduce to in the sense above.

14 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

1.4 Who is this book for? I view this book as useful to several audiences, in several different ways. • First, it is an invitation to advanced undergraduates and beginning graduate students in Math, CS and related fields, to find out what this field is about, get excited and join it as researchers. • Second, it should serve graduate students and young researchers working in some area of CS theory to broaden their view and deepen their understanding about other parts of the field and their interconnectivity.

• Third, computer scientists, mathematicians and researchers from other fields, as well as motivated non-academics, can get a high-level view of computational complexity, its broad scope, achievements and ambitions. • Last but not least, educators in the field can use different parts of the book for planning and supplementing a variety of undergraduate and graduate courses. We hope that the conceptual view of the field, its methodology, its unity, and the beauty and excitement of its achievements and challenges that we have labored to present here will be reflected in these courses. While different chapters may require somewhat different background, the introduction to each is aimed to be welcoming and gentle. The first two chapters, and the last one should be accessible to most audiences above. Let me conclude with a piece of advice that may be useful to some readers. It can be tempting to read this book quickly. Many parts of the book require hardly any specific prior knowledge, and count mostly on mathematical maturity needed to take in the definitions and notions introduced. Hopefully, the story-telling makes the reading even easier. However, the book (like the field itself) is conceptually dense, and in some parts the concentration of concepts and ideas requires, I believe, slowing down, re-reading, and possibly looking at a relevant reference, to clarify and solidify the material and its meaning in your mind.

1.5 Organization of the book Below we summarize the contents of each chapter in the book. Naturally, some of the notions mentioned below will only be explained in the chapters themselves. We also note that after the introductory chapters 2 and 3, the remaining ones can be read in almost any order. Central concepts (besides computation itself) that sweep several chapters include randomness (chapters 7–10), proof (chapters 3, 6, 10) and hardness (chapters 5, 6, 12). Different collections can be made around the focus of different sets of chapters. The first chapters 2–12 focus mostly on one computational resource, time, namely the number steps taken by a single machine (of various types) to solve a problem. The later chapters 14–19 (as well as 10) deal with other resources, and with more complex computational environments in which there is interaction between several computational devices. Finally, while mathematical modeling is an important part of almost every chapter, it is even more so for the complex computational environments we’ll meet in chapters 15–19; here modeling options, choices and rationale are discussed in greater length. Chapters 13 and 20 are stand-alone surveys, the first on concrete interactions between math and

15 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

computational complexity and the second on the Theory of Computation. Here are brief descriptions of each chapter (the headlines below may diﬀer than the chapter title).

Prelude: computation and mathematical understanding. In Chapter 2, we give the prelude to the arrival of computational complexity, starting with the formalization of the notion of algorithm as the Turing machine. We discuss basic computational problems in mathematics, and algorithms for them. We then argue the relevance of the boundary between decidable and undecidable problems about classes of mathematical structures, to the hope of completely understanding them.

Computational complexity 101, and the P vs. NP question. In Chapter 3 we introduce the basic concepts of computational complexity: decision problems, time complexity, polynomial vs. exponential time, efficient algorithms and the class P. We define efficient verification and the class NP, the first computational notion of proof. We proceed with efficient reductions between problems and the notion of completeness. We then introduce NP-complete problems and the P vs. NP question. Finally, we discuss related problems and complexity classes. For all of these notions we motivate some of the choices made, and explain their importance for computer science, math and beyond.

Diﬀerent types of computational problems and complexity classes. In Chapter 4 we introduce new types of questions one can ask about an input beyond classiﬁcation, including counting, approximation, search and others. We also move from worst-case performance of algorithms, to success or failure on average, and discuss the related notions of one-way and trap-door functions underlying cryptography. We explain how the methodology developed in the previous chapter leads to other complexity classes, reductions and completeness. This begins to paint the richer structure organizing problems above, below and “around” NP.

Hardness, and the diﬃculties it presents. In Chapter 5 we discuss lower bounds—the major challenge of proving that P is diﬀerent from NP, and more generally proving that some natural computational problems are hard. Central to this section is the model of Boolean circuits, a “hardware” analog of Turing machines. We review the main techniques used for lower bounds on restricted forms of circuits and Turing machines. We also discuss the introspective “barrier” results explaining why these techniques seem to fall short of the “real thing”—lower bounds for general models.

How deep is your proof? In Chapter 6 we introduce proof complexity, another view of the basic concept of proof. Proof complexity applies computational complexity methodology to quantify the difficulty of proving natural theorems. We describe a variety of propositional proof systems—geometric, algebraic and logical— all capturing different ways and intuitions of making deductions for proving natural tautologies. We explain the ties between proof systems, algorithms, circuit complexity and the Space: the final frontier problem. We review the main results and challenges in proving lower bounds in this setting.

The power and weakness of randomness for algorithms. In Chapter 7 we study using randomness to enhance the power of algorithms. We deﬁne proba-

16 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

bilistic algorithms and the class BPP of problems they solve eﬃciently. We describe such problems (among numerous others), for which no fast deterministic algorithms are known; this suggests randomness is powerful. However, this may be an illusion! We next introduce the fundamental notions of computational pseudo-randomness, pseudo-random generators, the hardness-versus-randomness paradigm and de-randomization. These suggest that randomness is weak, at least assuming hardness statements like P= 6 NP. We conclude with a discussion of the evolution and sources of these ideas, their surprising consequences, and their impact beyond the power of randomness.

Is π random? In Chapter 8 we discuss “random looking” deterministic structures. We discuss “abstract” pseudo- randomness, a general framework which extends computational pseudo-randomness, and accommo- dates a variety of natural problems in mathematics and computer science. We deﬁne pseudo-random properties, and discuss the question of deterministically ﬁnding pseudo-random objects. We explain how the P vs. NP problem, the Riemann hypothesis and many other problems naturally fall into this framework, namely can be viewed as questions about pseudo-randomness. Finally we discuss the structure vs. pseudo-randomness dichotomy, a paradigm for proving theorems in a variety of areas, and exemplify the scope of this idea.

Utilizing the unpredictability of the weather, stock prices, quantum effects, etc. In Chapter 9 we discuss weak random sources, a mathematical model of some natural phenomena which seem to be somewhat unpredictable, but may be far from a perfect stream of random bits. We raise the question of if and how probabilistic algorithms can utilize such weak randomness, and define the main object used to answer this question—the randomness extractor. We then define the evolution of ideas leading to efficient constructions of extractors, and the remarkable utility of this pseudo-random object for other purposes.

Interactive proofs: teaching students with coin tosses. In Chapter 10 we talk yet again about proofs—this time on the impact of introducing randomness and interaction into the deﬁnition of proofs. These new notions of proofs give rise to new complexity classes, like IP and PCP, and their surprising characterization in terms of standard complexity classes. We explain how this setting allows new properties of proofs, like zero-knowledge proofs and spot-checking proofs, and the implications of these on cryptography and hardness-of-approximation.

Schroedinger’s laptop: algorithms meet quantum mechanics. In Chapter 11 we introduce quantum computing, algorithms endowed with the ability to use quantum mechanical effects in their computation. We discuss important algorithms for this theoretical model, how they motivated a large-scale effort to build quantum computers, and the status of this effort. We extend the notion of proofs again using this notion, and discuss complete problems for quantum proofs. This turns out to directly connect to quantum Hamiltonian dynamics, a central area in condensed matter physics, and we explain some of the interactions between the fields. Finally we discuss the power of interactive proofs in answering the basic question: is quantum mechanics falsifiable?

Arithmetic complexity: Plus and Times revisited. In Chapter 12 we leave the Boolean domain and introduce the model of arithmetic circuits, which

17 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

use arithmetic operations to compute polynomials over (large) ﬁelds. We review the main results and open problems in this area, relating it to the study of Boolean circuits. We exposit Valiant’s arithmetic complexity theory, its main complexity classes VP and VNP, and complete problems, the determinant and permanent polynomials. We discuss a recent approach to solve the VP vs. VNP problem via algebraic geometry and representation theory. We also survey a collection of restricted models for which strong lower bounds are known.

All chapters above focus on one primary computational resource: time (or more generally, the number of elementary operations). Before broadening our scope, we take a break with an interlude.

Interlude: vignettes of interaction between math & computation. Chapter 13 is different from the others. It is the middle of the book and we take a (technical) break. In this interlude, we present a collection of short surveys on the interactions of complexity theorists and mathematicians in different mathematical areas. These vignettes span a wide spectrum of topics, as well as different types of interactions and motivations for them. They reveal the breadth of interests of computational complexity, and exemplify the “computational lens” on mathematics.

After this breather, we move to study a larger variety of computational problems, resources, models and properties. Modeling complex computational situations becomes even more important, interesting and diﬃcult, as e.g. the number of participants in computation increases, the full input (or even the problem solved) may not be known, and new eﬃciency measures and success criteria enter.

Space complexity: memory bottlenecks. Up to this point the main complexity measure we studied was time, or more generally the number of basic operations performed by an algorithm. In Chapter 14 we discuss space complexity: the memory requirements of algorithms. After introducing some basic results and open problems of this area, we focus on two speciﬁc issues in which surprising feats can be performed with surprisingly little memory. We ﬁrst discuss the streaming model and the sketching technique. We then demonstrate how to count arbitrarily high with only constant memory.

Communication complexity: information bottlenecks and noise. In Chapter 15 we meet communication complexity—an extremely simple, completely information theoretic model for 2-party communication. Its study, however, reveals surprising depth and breadth, and basic results in this simple model turn out to have important applications to understanding a surprisingly diverse set of computational models. We also describe how this interactive communication setting suggests extensions of classical questions in the ﬁelds of information theory and coding theory. We review some the main results and challenges in understanding these extensions.

On-line computation: Is clairvoyance overrated? In Chapter 16 we discuss on-line algorithms—reactive systems which need to respond to a continuous stream of requests or signals, attempting to optimize a goal which depends on the future. We ﬁrst explain how to model and measure the quality of such algorithms via the notion of competitive analysis. We then exemplify (again) the surprising power such restricted algorithms can have in a

18 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

variety of situations, from operating systems to the stock market.

Learning: how do programs recognize spam, know your taste and beat you in Chess? In Chapter 17 we discuss computational learning theory, and the complex task of understanding and designing systems that make sense, cope with and thrive in unfamiliar and unspecified environments. We illustrate fundamental modeling issues and proposals in the teacher-student framework of supervised learning, aimed to capture the ability to “generalize” given labeled examples into “concepts”. We review two different approaches to modeling learning in this setting, the “logical” approach of “identification in the limit”, and the “statistical” approach of “distribution-free learning”. We describe some learning algorithms in these settings, key methods and insights of their analysis, and the severe limitations of both.

Crypto: secrets and lies, knowledge and trust. In Chapter 18 we move to cryptography, one of the most complex computational environment possible. What are the guts of Internet purchases or electronic voting protocols? Here many agents and their algorithms interact to achieve some common goal, necessarily using their personal data. However they wish to keep the information private from illegitimate eavesdroppers, and ensure that achieving the goal is resilient to saboteurs. We’ll exposit the wealth of cryptographic tasks and constraints, and the principles of modeling them mathematically. We’ll see how numerous, provably impossible tasks (like playing a game of Poker over the telephone), can paradoxically be performed when computational power is limited. We describe the evolution of the comprehensive theory which enables achieving them.

Distributed environments: Asynchrony and symmetry breaking. Chapter 19, on distributed computation, also deals with interacting parties. However, our focus here will be on a very diﬀerent hurdle: asynchrony. Here participants have no common clock, and have to compute in the presence of arbitrary communication delays. We discuss modeling such constraints, and the limitations they impose. Here too a beautiful theory evolved which charts precisely the boundary between which tasks are possible and which are not, which rests on deep connections of these questions to topology.

Epilogue: The nature of the Theory of Computation Chapter 20 concludes this book with a panoramic view of the ToC and its immense intellectual impact. It aims to survey many aspects of the field, both scientific and social. It surveys some of the explosion of connections of ToC with the natural and social sciences, integrating the computational lens into models and theories of nature and society. ToC is revealed as an independent academic discipline, central to most others. We discuss some of the field’s intellectual and educational long- term challenges, its social character, and its adaptation to the growing role it will have to face as its scope and mission expand.

1.6 Asymptotic Notation Most notation in the book is introduced as we need it. We only specify here one essential piece of notation, on the asymptotic relation between functions on the integers. For integer functions, f, g we will use f = O(g) if for some positive constant C we have that for all large enough n,

19 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

f(n) ≤ C · g(n). Similarly, we will use f = Ω(g) if for some positive constant c we have that for all large enough n, f(n) ≥ c · g(n). We write f = Θ(g) if both f = O(g) and f = Ω(g) hold. Finally, we use f = o(g) if f(n)/g(n) tends to zero as n tends to inﬁnity. We say that an integer function f grows (at most) polynomially, if there are constants A, c such that for all n, f(n) ≤ Anc. We say that f grows (at most) exponentially, if there are constants A, c such that for all n, f(n) ≤ A exp(nc).

20 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

NO YES Figure 1: Instances of problem (2) and their classiﬁcation. The left is a diagram of the “Trefoil knot” and the right of the “Unknot”.

2 Prelude: computation, undecidability and the limits of mathematical knowledge

Which mathematical structures can we hope to understand? Consider any particular class of mathematical objects, and any particular relevant property. We seek to understand which of the objects have the property and which do not. Examples of this very general classification problem include the following7. (1) Which Diophantine equations have solutions? (2) Which knots are unknotted? (3) Which planar maps are 4-colorable? (4) Which theorems are provable in Peano arithmetic? (5) Which pairs of smooth manifolds are diffeomorphic? (6) Which elementary statements about the Reals are true? (7) Which elliptic curves are modular? (8) Which dynamical systems are chaotic? A central question is what we mean by understanding. When are we satisfied that our classification problem has been reasonably solved? Are there problems like these which we can never solve? A central observation (popularized mainly by David Hilbert) is that “satisfactory” solutions usually provide (explicitly or implicitly) “mechanical procedures”, which when applied to an object, determine (in finite time) if it has the property or not. Hilbert’s problems (1) and (4) above were stated, it seems, with the expectation that the answer would be positive, namely that mathematicians would be able to understand them in this very sense.

7It is not essential that you understand every mathematical notion mentioned below. If curious, reading a Wikipedia level page should be more than enough.

21 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

YES YES

Figure 2: Instances of problem (3) and their classiﬁcation. Both maps are 4-colorable.

So, Hilbert identified mathematical knowledge with computational access to answers, but never formally defined computation. This was taken up by logicians in the early 20th century, and was met with resounding success in the 1930s. The breakthrough developments by Gödel,Turing, Church, and others led to several, quite different formal definitions of computation, which happily turned out to be identical in power. Of all, Turing’s 1936 paper [Tur36] was most influential. Indeed, it is easily the most influential math paper in history. In this extremely readable paper, Turing gave birth to the discipline of Computer Science, ignited the computer revolution which radically transformed society, solved Hilbert’s problem above, and more!8 Turing’s model of computation (quickly named a Turing machine), became one of the greatest intellectual inventions ever. Its elegant and simple design on the one hand, and its universal power (elucidated and exemplified by Turing) on the other hand immediately led to implementations, and the rapid progress since then has forever changed life on Earth. This paper serves as one of the most powerful demonstrations of how excellent theory predates and enables remarkable technological and scientific advance. But back to Hilbert’s motivation: finally having a rigorous definition of computation allowed proving mathematical theorems about the limits of its power! Turing defined an algorithm (also called a decision procedure) to be a Turing machine (in modern language, simply a computer program) which halts on every input in finite time. So, algorithms compute functions, and being finite objects themselves, one immediately sees from a Cantor-like diagonalization argument that some (indeed almost all) functions are not computable by algorithms (such functions are also called undecidable). But Turing went further, and showed that specific, natural functions, like Hilbert’s Entscheidungsproblem (4) above was undecidable (this was independently proved by Church as well). Turing’s elegant 1-page proof adapts a Gödelianself-reference argument on a Turing machine (and as a side bonus a similar argument gives a short proof of Gödel’sincompleteness theorem9). These demonstrate so powerfully the mathematical value of Turing’s basic computational model. Turing thus shattered Hilbert’s first dream. Problem (4) being undecidable means that we will never understand in general, in his sense, which theorems are provable (say in Peano arithmetic); no algorithm can discern provable from unprovable theorems. It took 35 more years to do the same to

8To all graduate students reading this book, let this be your model; Turing was a grad student at the time. And we will meet other foundational discoveries by graduate students later in the book. 9A fact which for some reason is still hidden from many undergraduates taking logic courses.

22 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Hilbert’s problem (1). Its undecidability (proved by Davis, Putnam, Robinson, and Mattiasevich in 1970) says that we will never understand in this way polynomial equations over integers; no algorithm can discern solvable from unsolvable ones. A crucial ingredient in those (and all other undecidability) results is showing that each of these mathematical structures (Peano proofs, integer polynomials) can “encode computation” (in particular, these seemingly static objects encode a dynamic process!). This is known today to hold for many different mathematical structures in algebra, topology, geometry, analysis, logic, and more, even though a priori the structures studied seem to be completely unrelated to computation. This ubiquity makes every mathematician a potential computer scientist in disguise. We shall return to refined versions of this idea later. Naturally, such negative results did not stop mathematical work on these structures and properties— it merely suggested the study of interesting subclasses of the given objects. Specific classes of Dio- phantine equations were understood much better, e.g. Fermat’s Last Theorem and the resolution of problem (7) regarding the modularity of elliptic curves. The same holds for restricted logics for number theory, e.g. Presburger arithmetic. The notion of a decision procedure (or algorithm) as a minimal requirement for understanding a mathematical problem has also led to direct positive results. It suggests that we should look for a decision procedure as a means, or as the first step for understanding a problem. With this goal in mind, Haken [Hak61] showed how knots can be understood in this sense, designing a decision procedure for problem (2), determining knottedness. Similarly Tarski [Tar51] showed that real-closed fields can be thus understood, designing a decision procedure for problem (6). Naturally, significant mathematical, structural understanding was needed to develop these algorithms. Haken developed the theory of normal surfaces and Tarski invented quantifier elimination for their algorithms; in both cases these ideas and techniques became cornerstones of their respective fields. These important examples, and many others like them, only underscore what has been obvious for centuries: mathematical and algorithmic understanding are strongly related and often go hand in hand, as discussed at length in the introduction. And what was true in previous centuries is truer in this one: the language of algorithms is compatible with and actually generalizes the language of equations and formulas (which are special cases of algorithms), and is a powerful language for understanding and explaining complex mathematical structures. The many decision procedures developed for basic mathematical classification problems, such as Haken’s and Tarski’s solutions to problems (2) and (6) respectively, demonstrate this notion of algorithmic understanding in principle. After all, what they guarantee is an algorithm that will deliver the correct solution in finite time. Should this satisfy us? Finite time can be very long, and it is very hard to distinguish a billion years from infinity. This is not just an abstract question. Both Haken’s and Tarski’s original algorithms were extremely slow, and computing their answer for objects of moderate size may indeed have required a billion years. This viewpoint suggests using a computational yardstick, and measuring the quality of understanding by the quality of the algorithms providing it. Indeed, we argue that better mathematical understanding of given mathematical structures often goes hand in hand with better algorithms for classifying their properties. Formalizing the notions of algorithms’ efficiency is the business of computational complexity theory, the subject of this book, which we shall start developing in the next section. But before we do, I would like to use the set of problems above to highlight a few other issues, which we will not develop further here. One basic issue raised by most of the problems above is the contrast between continuity in mathematics and discreteness of computation. Algorithms manipulate finite objects (like bits) in

23 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

discrete time steps. Knots, manifolds, dynamical systems, etc. are continuous objects. How can they be described to an algorithm and processed by it? As many readers would know, the answers vary, but finite descriptions exist for all. For example, we use knot diagrams for knots, triangulations for manifolds, symbolic description or successive approximations for dynamical systems etc. It is these discrete representations that are indeed used in algorithms for these (and other) continuous problems (as e.g. Haken’s algorithm demonstrates). Observe that this has to be the case; every continuous object we humans will ever consider has discrete representations! After all, Math textbooks and papers are finite sequences of characters from a finite alphabet, just like the input to Turing machines. And their readers, us, would never be able to process and discuss them otherwise. All this does not belittle the difficulties which may arise when seeking representations of continuous mathematical structures that would be useful for description, processing and discussion—it rather further illustrates the inevitable ties of mathematics and computation. Let me note that this issue is crucial even for representing simple discrete structures. Consider where mathematics would be if we continued using unary encodings of integers, and observe that the great invention of the decimal encoding (or more generally the positional number system) was motivated by, and came equipped with efficient algorithms for arithmetic manipulation! Problem (3) on the 4-colorability of planar maps points to a different aspect of the interaction of computation in mathematics. Many readers will know that problem (3) has a very simple decision procedure: answer ‘yes’ on every input. The correctness of this trivial algorithm is guaranteed by the highly non-trivial proof of the 4-color theorem of Appel and Haken [AH89]. This theorem states that in every planar map (as the ones used in Geography texts, and Figure2), each region can be colored from a set of 4 colors (e.g. Red, Blue, Green, Yellow) so that no two regions sharing a border get the same color. This mathematical proof was the first to use a computer program as an essential tool to check that an enormously large but finite number of finite graphs is indeed 4-colorable. This proof naturally raised numerous discussions and arguments on the value of such proofs; discussions which only intensified with time, as more and more proofs use computers in a similar way (another famous example is Hales’ proof of the Kepler conjecture). I leave it to the reader to contemplate the relative merits of computer vs. human generated proofs (and the task of distinguishing the two). Another point to make is that problem (3) may seem to some very different from the rest; all are well known “deep” problems of mathematics, whereas (3) seems “recreational”. Indeed in the 20th century it was quite popular in mathematics to call such problems “trivial” even without knowing the 4-color theorem, simply by virtue of the fact that a trivial brute-force algorithm which tries all (finitely many) possible colorings could determine the answer. This again brings us right back into the quality of algorithms we start explaining next; you may revisit the task of distinguishing “deep” and “trivial” problems after reading Section 3.1.

24 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

3 Computational complexity 101: the basics

In this section we shall develop the basic notions of data representation, efficient computations, efficient reductions between problems, efficient verification of proofs, the classes P, NP, and coNP, and the notion of NP-complete problems. We will focus on classification (or decision) problems; other types of problems, and classes, (enumeration, approximation, construction, etc.) are studied as well, and some will be discussed later in the book. When studying efficiency, we will focus on time as the primary resource of algorithms. By “time” we mean the number of elementary operations10 performed. Other resources of algorithms, such as memory, parallelism, communication, randomness and more are studied in computational complexity, and some will be treated later in the book.

3.1 Motivating examples Let us consider the following three classiﬁcation problems. As in the previous chapter, for each classiﬁcation (or decision) problem like these, we get a description of an object, and have to decide if it has the desired property or not. (10) Which Diophantine equations of the form Ax2 + By + C = 0 are solvable by positive integers?

(20) Which knots on 3-dimensional manifolds bound a surface of genus ≤ g? (30) Which planar maps are 3-colorable? Problem (10) is a restriction of problem (1) above. Problem (1) was undecidable, and it is natural to try to better understand more restricted classes of Diophantine equations. Problem (20) is a generalization of problem (2) above in two ways: the unknotting problem (2) considers the special case of the manifold R3 and genus g = 0. Problem (2) was decidable, and so we may want to understand if its generalization (20) is decidable as well. Problem (30) is an interesting variant of problem (3). While every map has a 4-coloring, not every map has a 3-coloring; some do and some don’t, and so this is another nontrivial classification problem to understand. Most mathematicians would tend to agree that these three problems have absolutely nothing to do with each other. They are each from very different fields—algebra, topology, and combinatorics, respectively—each with its completely different notions, goals and tools. However, the theorem below suggests that this view may be wrong. Theorem 3.1. Problems (10) , (20) and (30) are equivalent.

Moreover, the equivalence notion is natural and completely formal. Intuitively, any understanding we have of one problem, can be simply translated into a similar understanding of the other. The formal meaning of this equivalence will unfold in this chapter and be formalized in Subsection 3.9. To get there, we need to develop the language and machinery which yield such surprising results. We start with explaining (informally and by example) how such varied complex mathematical objects can be described in ﬁnite terms, eventually as a sequence of bits. Often there are several alternative representations, and typically it is simple to convert one to the other. Let us discuss the representation of inputs in these three problems.

10For example, reading/writing a ﬁnite amount of data from/to memory, or performing a logical or arithmetic operation involving a ﬁnite amount of data.

25 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

For problem (10) consider first the set of all equations of the form Ax2 +By +C = 0 with integer coefficients A, B, C. A finite representation of such equation is obvious—the triple of coefficients (A, B, C), say with each integer written in binary notation. Given such a triple, the decision problem is whether the corresponding polynomial has a positive integer root (x, y). Let 2DIO denote the subset of triples for which the answer is YES. Finite representation of inputs to problem (20) is tricky, but still natural. The inputs consist of a 3-dimensional manifold M, a knot K embedded on it, and an integer G. A finite representation can describe M by a triangulation (a finite collection of tetrahedra and their adjacencies). The knot K will be described as a closed path along edges of the given tetrahedra. Given a triple (M,K,G), the decision problem is whether a surface that K bounds has genus at most G. Let KNOT denote the subset for which the answer is YES. Finite representation of inputs to problem (30) is nontrivial as well. Let us discuss not maps but rather graphs, in which vertices represent the countries and edges represent adjacency of countries (this view is equivalent; for a planar map, its graph is simply its dual map). To describe a graph (in a way which makes its planarity evident), one elegant possibility is to use a simple and beautiful theorem of Fáry[Fár48] (discovered independently by others, and which has many proofs). It states that every planar graph has a straight line embedding in the plane (with no edges crossing). So, the input can be a set V of coordinates of the vertices (which can in fact be small integers), and a set E of edges, each a pair of elements from V . Let 3COL be the subset of those inputs (V,E) describing a 3-colorable map. Any finite object (integers, tuples of integers, finite graphs, finite complexes, etc.) can be represented naturally by binary sequences, over the alphabet {0, 1}, and this is how they will be described as inputs to algorithms. As discussed above, even continuous objects like knots have finite description and so can be described this way as well11. We will not discuss here subtle issues like whether objects have unique representations, or whether every binary sequence should represent a legal object, etc. It suffices to say (for the discussion level we aim at), that in most natural problems this encoding of inputs can be chosen such that these are not real issues, and moreover going back and forth between the object and its binary representation is simple and efficient (a notion to be formally defined below). Consequently, we let I denote the set of all finite binary sequences, and regard it as the set of inputs to all our classification problems. In this language, given a binary sequence x ∈ I we may interpret it as a triple of integers (A, B, C) and ask if the related equation is in 2DIO. This is problem (10). We can also interpret x as a triple (M,K,G) of manifold, knot and integer, and ask if it is in the set KNOT. This is problem (20), and the same can be done with (30). Theorem 3.1 states that there are simple translations (in both directions) between solving problem (10) and problem (20). More precisely, it provides efficiently computable functions f, h: I → I performing these translations: (A, B, C) ∈ 2DIO iff f(A, B, C) ∈ KNOT, and (M,K,G) ∈ KNOT iff h(M,K,G) ∈ 2DIO. Thus, an efficient algorithm to solve one of these problems immediately implies a similar one for the other. Putting it more dramatically, if we have gained enough understanding of topology

11Theories of algorithms which have continuous inputs, e.g. real or complex numbers, have been developed, e.g. in [BCSS98, BC06], but will not be discussed here.

26 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

to solve e.g. the knot genus problem, it means that we automatically have gained enough number theoretic understanding for solving these quadratic Diophantine problems (and vice versa!). The translating functions f and h are called reductions. We capture the simplicity of a reduction in computational terms, demanding that it will be efficiently computable. Similar pairs of reductions exist between the map 3-coloring problem and each of the other two problems. If sufficient understanding of graph theory leads to an efficient algorithm to determine if a given planar map is 3-colorable, similar algorithms follow for both KNOT and 2DIO. And vice versa—understanding any of them will similarly resolve 3-coloring. Note that this positive interpretation of this equivalence paints all three problems as equally “accessible”. But the flip side says that they are also equally “intractable”, as if any one of them lacks such an efficient classification algorithm, so do the other two! Indeed, with the better understanding of these equivalences today it seems more likely that the second interpretation is right: these problems are all hard-to-understand. When teaching this material in class, or in lectures to unsuspecting audiences, it is always fun to watch listeners’ amazement at these remarkably strong unexpected connections between such remote problems. I hope it had a similar impact on you. But then comes the time to dispel the mystery, and explain the source of these connections. Here we go.

3.2 Efficient computation and the class P Efficient algorithms are the engine which drive an ever growing part of industry and economy, and with it your everyday life. These jewels are embedded in most devices and applications you use daily. In this section we abstract a mathematical notion of efficient computation, polynomial-time algorithms. We motivate it and give examples of such algorithms. In all that follows, we focus on asymptotic complexity. Thus e.g. we care neither about the time it takes to factor the number 267 −1 (as much as Mersenne cared about it), nor about the time it takes to factor all 67-bit numbers, but rather about the asymptotic behavior of factoring n-bit numbers, as a function of the input length n. The asymptotic viewpoint is inherent to computational complexity theory, and we shall see in this book that it reveals structure which would be obscured by finite, precise analysis. We note that the dependence on input size does not exist in Computability theory, where algorithms are simply required to halt in finite time. However, much of the methodology of these fields was imported to computational complexity theory—complexity classes of problems, reductions between problems and complete problems, all of which we shall meet. Efficient computation (for a given problem) will be taken to be one whose runtime on any input of length n is bounded by a polynomial function in n. Let In denote all binary sequences in I of n length n, namely In = {0, 1} . Definition 3.2 (The class P). A function f : I → I is in the class P if there is an algorithm computing f and positive constants A, c, such that for every n and every x ∈ In the algorithm computes f(x) in at most Anc steps (namely, elementary operations). Note that the definition applies in particular to Boolean functions (whose output is {0, 1}) which capture classification problems (often called “decision problems”). We will abuse notation and sometimes think of P as the class containing only these classification problems. Observe that a function with a long output can be viewed as a sequence of Boolean functions, one for each output bit. This definition was suggested by Cobham [Cob65], Edmonds [Edm65a,Edm68] and Rabin [Rab67], all attempting to formally delineate efficient from just finite (in their cases, exponential time) algorithms. Of course, nontrivial polynomial-time algorithms were discovered earlier, long before the

27 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

computer age. Many were discovered by mathematicians, who needed efficient methods to calculate (by hand). The most ancient and famous example is of course Euclid’s GCD (greatest common divisor) algorithm mentioned earlier, which was invented to bypass the need to factor integers when computing their common factor. There are two major choices made in selecting P to model the class of efficiently computable functions, which are often debated and certainly demand explanation. One is the choice of polynomial as the bound on time in terms of input length, and the second is the choice of worst case requirement, namely that this time bound holds for all inputs. We discuss the motivation and importance of these two choices below. However, it is important to stress that these are not dog- matic: computational complexity has considered and investigated numerous other alternatives to these choices, e.g. many finer grained bounds on efficiency other than polynomial, as well as many different notions of average case and input dependent measures replacing the worst-case demands. Some of them will be discussed later in the book. Still, these choices were extremely important for the early days of computational complexity, revealing beautiful structure that will become solid foundation for the field and enable the later study finer and more diverse alternatives. Why polynomial? The choice of polynomial time to represent efficient computation seems arbitrary. However, this particular choice has justified itself over time from many points of view. We list some important ones. Polynomials typify “slowly growing” functions. The closure of polynomials under addition, multiplication and composition preserves the notion of efficiency under natural programming practices, such as using two programs in sequence, or using one as a subroutine of another. This choice removes the necessity to describe the computational model precisely (e.g. it does not matter if we allow arithmetic operations only on single digits or on arbitrary integers, since long addition, subtraction, multiplication and division have simple polynomial-time algorithms taught in grade school). Similarly, we need not worry about data representation: one can efficiently translate between essentially any two natural representations of a set of finite objects. From a practical viewpoint, a running time of, say, n2 is far more desirable than n100, and of course linear time is even better. Indeed even the constant coefficient of the polynomial running time can be crucial for real-life feasibility of an algorithm. However, there seems to be a “law of small numbers” at work, in that very few known polynomial-time algorithms for natural problems have exponents above 3 or 4 (even though at discovery the initial exponent may have been 30 or 40). On the other hand, many important natural problems which so far resist any efficient algorithms, cannot at present be solved faster than in exponential time (which of course is totally impractical even for small input data). This exponential gap gives great motivation for the definition of P; reducing the complexity of such problems from exponential to (any) polynomial will be a huge conceptual improvement, likely involving new techniques. Why worst-case? Another criticism of the definition of the class P is that a problem is deemed efficiently solvable if every input of length n can be solved in poly(n)-time. From a practical standpoint, it would suffice that the instances we care about (e.g. those generated by our application, be it industry or nature) be solved quickly by our algorithms, and the rest can take a long time. Perhaps it suffices that “typical” instances be solved quickly. Of course, understanding what instances arise in practice is a great problem in itself, and a variety of models of typical behavior and algorithms for them are studied (and we shall mention this later). The clear advantage of “worst-case” analysis is that we don’t have to worry about which instances arise — they will all be solved quickly by what we call an efficient algorithm. This notion composes well, when one

28 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

algorithm is using another. Moreover, it accounts for adversarial situation, where an input (or more generally, external behavior) is generated by an unknown opponent who wishes to slow down the algorithm (or system) - modeling such adversaries is crucial in such fields as cryptography and error correction, and is facilitated by worst-case analysis. Finally, as mentioned, this notion turned out to reveal a very elegant structure of the complexity universe, which inspired the more refined study of average-case and instance-specific theories. Understanding the class P is central. There are numerous computational problems that arise (in theory and practice) which demand efficient solutions. Many algorithmic techniques were developed in the past four decades and enable solving many of these problems (see e.g. the textbooks [CLR01, KT06]). These drive the ultra-fast home computer applications we now take for granted like web searching, spell checking, data processing, computer game graphics, and fast arithmetic, as well as heavier duty programs used across industry, business, math, and science. But many more problems yet (some of which we shall meet soon), perhaps of higher practical and theoretical value, remain elusive. The challenge of characterizing this fundamental mathematical object—the class P of efficiently solvable problems—is far beyond us at this point. We end this section with some examples of nontrivial problems in P of mathematical significance from diverse areas. In each, the interplay between mathematical and computational understanding needed for the development of these algorithms is evident. Most examples are elementary in nature, but ff some mathematical notion is unfamiliar, feel free to ignore that example or possibly better, look up its meaning. Some problems in P • Perfect Matching. Given a graph, test if it has a perfect matching, namely a pairing of all its vertices such that every pair is an edge of the graph (see Figure3). The ingenious algorithm of Edmonds [Edm65a] is probably the first non-trivial algorithm in P, and as mentioned above, this paper was central to highlighting P as an important class to study. The structure of matchings in graphs is one of the most well-studied subject in combinatorics (see e.g. [LP09]).

• Primality testing. Given an integer, determine if it is prime12. Gauss literally appealed to the mathematical community to ﬁnd an eﬃcient algorithm, but it took two centuries to resolve. The story of this recent achievement of Agrawal, Kayal and Saxena [AKS04] and its history is beautifully recounted by Granville in [Gra05]. Of course, there is no need to elaborate on how central prime numbers are in mathematics (and even popular culture).

• Planarity testing. Given a graph, determine if it is planar, namely if it can it be embedded in the plane without any edges crossing (try to determine this for the graphs in Figure3, and those in Figure5). A sequence of linear time algorithms for this basic problem was discovered, starting with the paper of Hopcroft and Tarjan [HT74]. • Linear programming. Given a set of linear inequalities in many variables, determine if they are mutually consistent, namely, there are real values to the variables satisfying all inequalities (a small example is in Figure4). This problem, and its optimization version, is enormously useful in applications. It captures many other problems, e.g. ﬁnding optimal strategies of zero-sum games. The convex optimization techniques used to give the eﬃcient algorithms [Kha79], [Kar84] for it actually do much more (see e.g. Schrijver’s book [Sch03]).

12E.g. try to determine the answer for X − 1 and X + 1, where X = 6797727 × 215328.

29 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Figure 3: A graph with a perfect matching (shown) and one without a perfect matching

7 7 y ≤ 2 − x 5 y ≥ 2 − x 5 y ≤ 3 x − 1 y ≥ 3 x − 1

2 2 y ≥ 3 x y ≤ 3 x

(a) A feasible linear program (b) An infeasible linear program

Figure 4: Two linear programs with 2 variables and 3 inequalities.

30 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• Factoring polynomials. Given a multivariate polynomial with rational coefficients, find its irreducible factors over Q. The tools developed by Lenstra, Lenstra and Lovászin [LLL82] (mainly regarding “short” bases in lattices in Rn) have many other applications (see Sec- tion 13.8). • Hereditary graph properties. Given a finite graph, test if it is a member of some fixed minor-closed family13. A polynomial-time algorithm (which has a huge exponent in general) follows Robertson and Seymour’s monumental structure theory [RS95] of such families, including a finite basis theorem14. • Permutation group membership. Given a list of permutations on n elements, can the first one be generated by the rest?15 The “non-commutative Gaussian elimination” techniques developed in [Sim70,FHL80] started off a development of algorithmic group theory, of extensive use by group theorists, and which in particular lead to the breakthrough on testing graph isomorphism [Bab15]. • Hyperbolic word problem. Given any presentation of a hyperbolic group by generators and relations, and a word w in the generators, check whether w represents the identity element. Gromov’s geometric techniques, including isoperimetric bounds on the Cayley graphs of such groups [Gro87], allow a polynomial-time algorithm (and more). Note that for general finitely presented groups, this problem is undecidable.

3.3 Efficient verification and the class NP Let C ⊂ I be a classification problem16. We are given an input x ∈ I (describing a mathematical object) and are supposed to determine if x ∈ C or not. It is convenient for this section to view C as defining a property; x ∈ C are objects having the property, and x 6∈ C are objects which do not. If we have an efficient algorithm for C, we can simply apply it to x and know if x has property C. But if we do not, what is the next best thing? One answer is, a convincing proof that x ∈ C. Before defining it formally, let us see a couple of motivating examples. The first example is a famous anecdote of a lecture given by F. N. Cole, entitled “On the Factorization of Large Numbers”, given at the 1903 American Math Society meeting. Without uttering a word, he went to the blackboard, wrote

267 − 1 = 147573952589676412927 = 193707721 × 761838257287 and proceeded to perform the long multiplication of the integers on the right-hand side to derive the integer on the left: Mersenne’s 67th number (which was conjectured to be prime). No one in the audience had any questions. What has happened there? Cole demonstrated that the number 267 −1 is composite. Indeed, we can see that such a short proof can be given for any (correct) claim of the form x ∈ COMPOSITES, with COMPOSITES denoting the set of composite numbers. The proof can simply be a factorization of x. The features we want to extract from this episode are two: the proofs here are short and

13Namely, removing a vertex or edge, and contracting an edge, leave a graph in the family. 14Every such family has a ﬁnite number of excluded minors. 15A famous special case is the question, given a color pattern of a Rubik’s cube (perhaps obtained by placing colored stickers illegally), can it be sorted to monochromatic faces by legal Rubik moves? 16In the computer science literature, C is often called a language.

31 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

easily verifiable. Indeed, the total length of the factors is roughly the length of the input, and multiplying them has an efficient algorithm. Note that the fact that it was extremely difficult for Cole to find these factors (he said it took him “three years of Sundays”) did not affect in any way that demonstration. A second example, which many of us meet daily, is what happens when we read a typical math journal paper. In it, we typically find a (claimed) theorem, followed by an (alleged) proof. Thus, we are verifying claims of the type x ∈ THEOREMS, where THEOREMS is the set of all provable statements in, say, set theory. It is taken for granted that the written proof is short (page limit) and easily verifiable (a referee can do it in reasonable time), so at least on an intuitive level THEOREMS has the same properties as COMPOSITES, and this can be made formal. Note again that we don’t care how long it took the authors took to find the proof. Needless to say, theorems and proofs in mathematical journals are not really written in a formal language; indeed one can interpret the task of refereeing as verifying that these “semi-formal” proofs could be converted into formal ones that will establish the truth of the statements they claim to prove. Now we are ready for a definition of NP, the class of problems generalizing these two examples. The class NP contains all properties C for which membership (namely statements of the form x ∈ C) have short, efficiently verifiable proofs. As before, we use polynomials to define both terms. A candidate proof y for the claim x ∈ C must have length at most polynomial in the length of x. And the verification that a given y indeed proves the claim x ∈ C must be checkable in polynomial time (via a verification algorithm we will call VC ). Finally, if x 6∈ C, no such y should exist. Let us formalize it:

Deﬁnition 3.3 (The class NP). The set C is in the class NP if there is a function VC ∈ P and a constant k such that

k • If x ∈ C then ∃y with |y| ≤ k · |x| and VC (x, y) = 1.

• If x 6∈ C then ∀y we have VC (x, y) = 0. From a logic standpoint, each set C in NP may be viewed as a set of theorems in the complete and sound proof system defined by the verification process VC . A sequence y which “convinces” VC that x ∈ C is often called a witness or certificate for the membership of x in C. Again, we stress that the definition of NP is not concerned with how difficult it is to come up with a witness y, but rather only with the efficient verification using y that x ∈ C. The witness y (if it exists) can be viewed as given by an omnipotent entity, or simply guessed. Indeed, the acronym NP stands for “Nondeterministic Polynomial time”, where the nondeterminism captures the ability of a hypothetical “nondeterministic” machine to “guess” a witness y (if one exists), and then verify it deterministically. Nonetheless, the complexity of finding a witness is, of course, important, as it captures the search problem associated to NP sets. Every decision problem C (indeed every verifier VC for C) in NP defines a natural search problem associated to it: Given x ∈ C, find a short witness y that “convinces” VC of this fact. A correct solution to this search problem can be efficiently verified by VC , by definition. It is clear that finding a witness (if one exists) can be done by “brute-force” search: as witnesses are short (of length poly(n) for a length n input), one can enumerate all possible ones, and to each apply the verification procedure. However, this enumeration takes exponential time in n. The major question of this chapter (and this book, and the theory of computation!) is whether much faster algorithms than brute-force exist for all NP problems.

32 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

While it is usually the search problems which arise more naturally, it is often more convenient to study the decision versions of these problems (namely, weather a short witness exists or not). In almost all cases both decision and search versions are computationally equivalent17. Here is a list of some problems (or rather properties) in NP. Note that some are variants on the problems in the similar list we gave for the class P. However, we have no idea if any of these are in P. It is a good exercise (easy for most but not all) for the reader to deﬁne for each of them the short, easily veriﬁable witnesses for inputs having the property18. Some problems in NP • Hamiltonian cycle in graphs. The set of graphs having a Hamilton cycle, namely a cycle of edges passing through every vertex exactly once. • Factoring integers. Triples of integers (x, a, b), such that x has a prime factor in the interval [a, b]. • Integer programming. Sets of linear inequalities in many variables, which have an integer solution.

• Matrix group membership. Triples (A, B, C) of invertible matrices (say over F2) of the same size, such that A is in the subgroup generated by B,C. • Graph isomorphism. Pairs of graphs which are isomorphic, namely having a bijection between their vertex sets which extends to a bijection on their edge sets.

• Polynomial root. Multivariate polynomials of degree 3 over F2 which have a root (namely an assignment to the variables on which it evaluates to 0).

Figure 5: Which of these graphs are Hamiltonian? Which pairs of these graphs are isomorphic?

It is evident that decision problems in P are also in NP. The veriﬁer VC is simply taken to be the eﬃcient algorithm for C, and the witness y can be the empty sequence. Corollary 3.4. P ⊆ N P.

17 A notable possible exception is the set COMPOSITES and the suggested verification procedure to it, accepting as witness a nontrivial factor. Note that while COMPOSITES ∈ P as a decision problem, the related search problem is equivalent to Integer Factorization, which is not known to have an efficient algorithm. 18The one difficult exception is Matrix Group Membership, which if you cannot resolve yourself peek in the beautiful [BS84].

33 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

But can we solve all NP problems eﬃciently? Can we vastly improve the trivial “brute-force” exponential time algorithm mentioned above to polynomial time for all NP problems? This is the celebrated P vs. NP question. Open Problem 3.5. Is P = NP?

The definition of NP, and the explicit P = NP? question (and much more we will soon learn about) appeared formally first (independently and in slightly different forms) in the papers of Cook [Coo71] and Levin [Lev73] in the early 1970s, one in America and the other in the Soviet Union. However, both the definition and question appeared informally earlier, again independently in the East and West, but with similar motivations. They all struggle with the tractability of solving problems for which finite algorithms exist, including finding finite proofs of theorems, short logical circuits for Boolean functions, isomorphism of graphs, and a variety of optimization problems of practical and theoretical interest. In all these examples, exhaustive search was an obvious but exponentially expensive solution, and the goal of improving it by a possibly more clever (and faster) algorithm was sought, hopefully one of polynomial complexity, namely in P. The key recognition was identifying the superclass NP that so neatly encompasses almost all the seemingly intractable problems people really cared about and struggled with above. The excellent survey of Sipser [Sip92] describes this history as well as gives excerpts from important original papers, and we mention only a few precursors to the papers above. In the Soviet Union, Yablonskii and his school studied Perebor, literally meaning “exhaustive, brute-force search”, and Levin’s paper continues this line of research (see Trakhtenbrot’s survey [Tra84] of this work, including a corrected translation of Levin’s paper). In the West, Edmonds [Edm66] was the first to explicitly suggest “good characterization” of the short, efficiently verifiable type (which he motivates by a teacher-student interaction, although in a slightly stricter sense than NP which we will soon meet in Section 3.5). But already in 1956, a decade earlier, a remarkable letter (discovered only in the 1990s) written by Gödelto von Neumann essentially introduces P, NP, the P vs. NP question, in rather modern language. It raises this fundamental problem of overcoming brute-force search, exemplifies that it is sometimes nontrivially possible, and demonstrates clearly how aware Gödelwas of the significance. Unfortunately, von Neumann was already dying of cancer at the time, and it is not known if he ever responded or if Gödelhad further thoughts on the subject. Another very appealing feature of the P vs. NP question (which was a source of early optimism about its possible quick resolution) is that it can be naturally viewed as a bounded analog of the decidability question from computability theory, which we already discussed implicitly in the Prelude. To see this, replace the polynomial-time bound by a finite bound in both classes. For P, the analog becomes all problems having finite algorithms, namely the decidable problems, sometimes called Recursive problems and denoted by R. For NP, the analog is the class of properties for which membership can be certified by a finite witness via a finite verification algorithm. This class of problems is called Recursively Enumerable, or RE. It is easy to see that most problems mentioned in the introduction are in this class. For example, consider the properties defined by problems (1) and (4) from the Prelude, respectively the solvable Diophantine equations and the theorems provable in Peano arithmetic. In the first, an integer root of a polynomial is clearly a finite witness that can be easily verified by evaluation in finite time. In the second, a Peano proof of a given theorem is a finite witness, and the chain of deductions of the proof can be easily verified in finite time. Thus both problems are in RE. We already know that both problems are undecidable, namely are not in R, and so can conclude that R= 6 RE. With nearly half century of experience, we realize that resolving P vs. NP is much harder than

34 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

R vs. RE. A possible analogy (with a much longer history) is the difficulty of resolving the Riemann Hypothesis, though we have known for millennia that there are infinitely many primes. In both contexts, what we already know is very qualitative, separating the finite and infinite, and what we want to know are very precise, quantitative versions. Also in both, some weak quantitative results were proved along the way. The prime number theorem is a much finer quantitative result about the distribution of primes than their infinitude. This book will discuss analogous quantitative progress on the computational complexity of natural problems. In both cases the long term goals seem to require much deeper understanding of the respective fields, and far better tools and techniques. Incidentally, we will discuss a completely different analogy between the P vs. NP question and the Riemann Hypothesis in Chapter8.

3.4 The P versus NP question, its meaning and importance Should you care about the P versus NP question? The previous sections make a clear case that it is a very important question of computer science. It is also a precise mathematical question; how about its importance for mathematics? For some mathematicians, the presence of this question in the list of seven Clay Millennium Prize Problems [CJW06], alongside the Riemann Hypothesis and the PoincaréConjecture (which was since resolved), may be sufficient reason to care. After all, these problems were selected by top mathematicians in the year 2000 as major challenges for the next millennium, each carrying a prize of one million dollars for its solution. In this section I hope to explain the ways in which the P = NP? question is unique not only among the Clay problems, but among all mathematics questions ever asked, in its immense practical and scientific importance, and its deep philosophical content. In a (very informal, sensational) nutshell, it can be summarized as follows: Can we solve all the problems we can “legitimately” hope to solve? where the royal “we” here can stand for anyone or everyone, representing the general human thrust for knowledge and understanding. In particular, this phrasing of the P = NP? question clearly addresses the possibility of resolving extant and future conjectures and open problems raised by mathematicians, at the very least problems regarding classifications of mathematical objects. To support this overarching interpretation of the P = NP? question above, we will try to understand in high level and intuitive terms which problems occupy these two important classes. In fact, we have already intuitively identified the class P with a good approximation of all problems we can solve (efficiently, e.g. in our lifetimes). So next we embark on intuitively identifying NP as a good approximation of all “interesting” problems, those we are really investing effort in trying to solve, believing that we possibly can. Note that any argument for this interpretation will have to explain why undecidable problems (that are clearly not in P) are not really “interesting” in this sense. The very idea that all (or even most, or even very many) “interesting” problems can be mathematically identified is certainly audacious. Let us consider it, progressing slowly. We caution that this discussion is mainly of a philosophical nature, and the arguments I make here are imprecise and informal, representing my personal views. I encourage the reader to poke holes in these arguments, but I also challenge the reader to consider whether counterexamples found to general claims made here are typical or exceptional. After this section, we shall soon return to the sure footing of mathematics! So, which problems occupy NP? The class NP turns out to be extremely rich. There are literally thousands of NP problems in mathematics, optimization, artificial intelligence, biology,

35 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

physics, economics, industry, and more which arise naturally out of very different necessities, and whose efficient solutions will benefit us in numerous ways. What is common to all these, possibly hard problems, which nevertheless separates them from certainly hard problems (like undecidable ones)? To explore this, it is worth while to consider a related question. What explains the abundance of so many natural, important, diverse problems in the class NP? After all, this class was defined as a technical, mathematical notion by computational theorists. Probing the intuitive meaning of the definition of NP, we will see that it captures many tasks of human endeavor for which a successful completion can be easily recognized. Consider the following professions, and the typical tasks they are facing (this will be extremely superficial, but nevertheless instructive):

• Mathematician: Given a mathematical claim, come up with a proof for it. • Scientist: Given a collection of data on some phenomena, ﬁnd a theory explaining it.

• Engineer: Given a set of constraints (on cost, physical laws, etc.) come up with a design (of an engine, bridge, laptop . . . ) which meets these constraints. • Detective: Given the crime scene, ﬁnd “who’s done it”.

Consider what may be a common feature of this multitude of tasks. I claim that in almost all cases, “we can tell” a good19 solution when we see one (or we at least believe that we can). Simply put, would you embark on a discovery process if you didn’t expect to recognize what you set out to find? It would be good for the reader to consider this statement seriously, and try to look for counterexamples. Of course, in different settings the “we” above may refer to members of the academic community, customers of various products, or the jury in different trials. I have had many fun discussions, especially after lectures on the subject, of whether scientists or even artists are indeed in the mental state described. It seems to me that in these cases, the very decision to tell (or not) others of our creations typically follows the application of such a “goodness test” to our work. If so, embarking on the task we (implicitly or explicitly) expected the solution (or creation) to essentially bear the burden of proof of goodness that we can test, namely be short, and efficiently verifiable, just as in the definition of NP. The richness of NP follows from the simple fact that such tasks abound, and their mathematical formulation is indeed an NP-problem. For all these tasks, finding solutions quickly is paramount, and so the importance of the P vs. NP question is evident. The colossal implications of the possibility that P = NP are evident as well: as that P represents efficiently solvable problems, we conclude that every instance of all these tasks can be solved efficiently20. Optimal solutions to humanity’s most burning questions—medical, social, industrial, scientific, mathematical, . . . — would be generated instantly (this is discussed in great detail and with many examples in Fortnow’s popular book [For13]). A positive answer to one precise mathematical question holds the key to achieving this utopia! I believe that this universal promise seems to distinguish the P vs. NP question from every other mathematical question ever asked. One can cast doubt on the strong statement above on several grounds. First, while most problems considered by humans may be of this nature, namely their solutions are easily recognizable,

19This may mean “optimal”, or “better than previous ones”, or “publishable”, or any criterion we establish for ourselves. 20In fact, a much larger class of problems, which include some without any clear way of recognizing solutions will become easy as well to solve.

36 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

using P = NP (if true) to find these solutions requires the efficient recognition procedure to be fully specifiable formally. My reaction to this is that for many important problems, especially in math, science and engineering, such procedures already exist. For other important problems, if P = NP is proved, there will be huge incentive to convert intuitive recognition procedures into formal ones, in order to use them so. Another doubt may be that the polynomial-time algorithms supplied by P = NP may be too slow in practice, e.g. because the polynomial time bound or the constants involved are too high. This indeed is possible, and will in turn provide huge incentive to improve the efficiency of the algorithm. As discussed in Section 3.2, most of these problems currently have only brute-force, exponential-time algorithms, and a polynomial-time algorithm (even inefficient) must represent significant new understanding, which should now be fine-tuned to become more efficient. So, should we believe that P = NP, and that such utopia is achievable? One (psychological) reason people feel that P = NP is unlikely is that tasks as above often require a degree of creativity or ingenuity which they do not expect a simple computer program to have. We admire Wiles’ proof of Fermat’s Last Theorem, the scientific theories of Newton, Einstein, Darwin, the design of the Golden Gate bridge and the Pyramids, and sometimes even Hercule Poirot’s and Miss Marple’s analysis of a murder, precisely because they seem to require a leap which cannot be made by everyone, let alone by a simple mechanical device. I tend to disagree with this particular intuition. Note that these are all specific discoveries, namely solving general problems on specific (highly important) instances. I see no reason that computers cannot do the same, as, after all, human brains (and all of nature) simply run efficient algorithms, like computers (nothing in our understanding of nature so far contradicts this, despite numerous speculations, writings and beliefs to the contrary). So, when we finally understand the algorithmic processes of the brain, we may indeed be able to automate the discovery of these specific achievements, and perhaps many others. Indeed, the strides recently made on many frontiers of artificial intelligence suggest that computers will eventually outdo humans on almost every task. But the question is whether we (humans or computers) can automate them all? Is it possible that every task for which verification is easy, finding a solution is not much harder? If P = NP, the answer is positive, and creativity (of this universally abundant, verifiable kind) can be completely automated, on every instance. Most computer scientists (including myself) believe that this is not the case for the following, more mundane empirical reason. Attempts of probably millions of man-hours across industry and academia have been invested in proving that P = NP. This monumental effort was mostly inadvertent, made of numerous independent projects (motivated mostly by potential profit of various applications, but also by mathematical curiosity) to find efficient algorithms for specific optimization problems. As will be explained in Section 3.8, if any of them succeeded, a proof that P = NP would follow. However, they all failed. Is this sufficient evidence? Hard to say, but this is the current widely held belief. Conjecture 3.6. P= 6 NP. To segue into discussing the world of P 6= NP we mention an important negative consequence of the P = NP world, which perhaps makes it a bit less utopic than it seems. In this world every code can be broken, practically disabling all Internet security and e-commerce applications as we know them. Indeed, it was the possibility that P= 6 NP which gave birth to complexity-based cryptography with its numerous applications used daily by all. Somehow, the existence of (specific, structured) hard problems whose solutions can be easily checked enables the creation of unbreakable codes between parties who have never before met (as is required e.g. for online shopping), and many other seemingly impossible tasks.

37 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

It is quite striking that hard problems, which can’t be solved, actually have applications! And so this world of P= 6 NP, in which we probably live, has advantages as well. The nature of hardness required is discussed in Section 4.5, with its full utility exposited in the Cryptography Chapter 18. The intimate connection of hardness and randomness will be discussed in Section 7.2. Given the discussion above, one may wonder why it is so hard to prove that indeed P= 6 NP— it may seem completely obvious that search is much harder than verification. We shall discuss attempts and difficulties in the next Chapter5. Before that, in this chapter, we will develop a methodology of reductions and completeness which will enable us to identify the hardest problems in NP, that might as well be the targets of any harness proof. These developments and understanding, enlightening and important as they are, still seem to leave us far from the resolution of P vs. NP. While we have argued here the huge importance of this question, its resolution (in either direction: P= 6 NP or P = NP) will only be the beginning, not the end of the story. As discussed, these classes are rather coarse, and only two of many interesting ones. If we develop techniques to resolve P vs. NP, one would hope they could be sharpened to determine far more precisely the computational resources needed to invest in solving specific problems! Much discussion and other perspectives of the P versus NP question, its meaning and importance, appear in all computational complexity texts and surveys we referenced before, as well as the newly published survey of Aaronson [Aar17]. We will have much more to say about this question, but first we take a detour and turn to discuss a related question with a strong connection to mathematics: the NP versus coNP question.

3.5 The class coNP, the NP versus coNP question, and efficient characterization We have discussed efficient computation and efficient verification, and now turn to define and discuss efficient characterization of properties. We note that attempts, mainly within combinatorics, graph theory and optimization, to find “good” characterizations (some successful ones, as for perfect matchings and Euler tours in graphs, and some failed ones, as for Hamiltonian cycles and colorings in graphs), were central to elucidating the definitions and importance of the concepts and classes in this chapter. Many of these, and the focus on formally defining the notion of “good” (in characterizations as well as in algorithms), go back Edmonds’ early optimization papers, mainly [Edm66]. Fix a property C ⊆ I. We already have the interpretations • C ∈ P if it is easy to check that object x has property C, • C ∈ N P if it is easy to certify that object x has property C, to which we now add • C ∈ coNP if it is easy to certify that object x does not have property C, where we formally define Definition 3.7 (The class coNP). A set C is in the class coNP iff its complement C¯ = I \ C is in NP. For example, the set PRIMES of all prime numbers is in coNP, since its complement COM- POSITES is in NP. Similarly, the set of non-Hamiltonian graphs is in coNP, since its complement, the set of all Hamiltonian graphs is in NP.

38 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

While the definition of the class P is symmetric21, the definition of the class NP is asymmetric. Having nice certificates that a given object has property C, by no means automatically entails nice certificates that a given object does not have this property. Indeed, when we can do both, namely having nice certificates for both the set and its complement, we are achieving one of mathematics’ holy grails of understanding structure, namely necessary and sufficient conditions, sometimes phrased as a characterization or a duality theorem. As we know well, such characterizations are rare. When insisting (as we shall) that the certificates are furthermore short, efficiently verifiable ones22, such characterizations are even rarer. This leads to the conjecture Conjecture 3.8. N P 6= coNP.

First note that this conjecture implies P= 6 NP. We shall discuss at length refinements of this conjecture in Section6 on proof complexity. Despite the shortage of such efficient characterizations, namely properties which are simultaneously in N P ∩ coNP, they nontrivially exist. This class was introduced by Edmonds in [Edm66], who called them problems with good characterization. Here is a list of some exemplary ones, following important theorems of (respectively) Menger, Dilworth, Farkas, von Neumann, and Pratt. We informally explain the NP and coNP witnesses for most, which can be seen to be efficiently verifiable. Of course, the crux is that for each of these problems, every instance of the problem possesses one such witness - having the property or violating it! Efficient duality theorems: problems in N P ∩ coNP • Graph connectivity. The set of graphs in which every pair of vertices is connected by (a given number) k disjoint paths. Here the NP -witness is a collection of such k paths between every pair, and the coNP-witness is a cut of k − 1 vertices whose removal disconnects some pair in the graph. • Partial order width. Finite partially ordered set (poset) whose largest anti-chain (a set of pairwise incomparable elements) has at least (a given number) w elements. Here the NP- witness is an anti-chain of w elements, and the coNP-witness is a partition of the given poset to w − 1 chains (totally ordered sets). • Linear programming. Systems of consistent linear inequalities. Here an NP-witness is a point satisfying all inequalities. A coNP-witness is a linear combination of the inequalities producing the contradiction 0 > 1.23

• Zero-sum games24. Finite zero-sum games (described by a Real payoff matrix) in which the first player can gain at least (some given value) v. Here the NP-witness is a strategy for first player (namely, a probability distribution on the rows) which guarantees her a payoff of v, and the coNP-witness is a strategy to the second player (namely, probability distribution on the columns) which guarantees that he pays less than v.

21Having a fast algorithm to determine if an object has a property C is equivalent to having a fast algorithm for the complementary set C¯. In other words, P = coP 22There are many famous duality theorems in mathematics which do not conform to this strict eﬃciency criterion, e.g. Hilbert’s Nullstellensatz. 23This duality generalizes to other convex bodies given by more general constraints, like semi-deﬁnite programming. Such extensions include the Kuhn-Tucker conditions, and the Hahn-Banach theorem. 24This problem was later discovered to be equivalent to linear programming.

39 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• Primes. Prime numbers. Here the coNP-witness is simple: tow nontrivial factors of the input. The reader is encouraged to attempt ﬁnding the NP-witness: a short certiﬁcate of primality. It requires only very elementary number theory25

NP coNP

F Tautologies F Satisﬁability N P ∩ coNP Hamiltonian F F Non-Hamiltonian graphs F Factorization graphs F Discrete log F Stochastic games P

F Linear programming F Graph connectivity

Figure 6: P, NP, and coNP

These examples of problems in N P ∩ coNP were chosen to make a point. At the time of their discovery, interest was seemingly focused only on characterizing these structures; it is not known if efficient algorithms for these problems were sought as well. However all of these problems above turned out to be in P, and their resolutions entered the Hall of Fame of efficient algorithms. Famous examples are the Ellipsoid method of Khachian [Kha79] and the Interior-Point method of Karmarkar [Kar84], both for Linear Programming, and the breakthrough algorithm of Agrawal, Kayal and Saxena [AKS04] for Primes26. Is there a moral to this story? Only that sometimes, when we have an efficient characterization of structure, we can hope for more: efficient algorithms. And conversely, a natural stepping stone towards an elusive efficient algorithm may be to first get an efficient characterization. Can we expect this magic to always happen? Is N P ∩ coNP = P? We do not have too many examples of problems in N P ∩ coNP which have resisted efficient algorithms. Some of the famous, like Integer Factoring and Discrete Logarithms27, arise from one-way functions which underlie cryptography (we discuss these in Section 4.5). Note that while they are not known to be hard, humanity literally banks on their intractability for electronic commerce security. Yet another

25 ∗ Hint: Roughly, the witness consists of a generator of Zp , a factorization of p − 1, and a recursive certiﬁcate of the same type for each of the factors. 26It is interesting that assuming the Generalized Riemann Hypothesis, a simple polynomial-time algorithm was given 30 years earlier by Miller [Mil76]. 27Which have to be properly deﬁned as decision problems.

40 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

famous example, for which membership in NP and in coNP are highly nontrivial (respectively proved in [Lac15] and [HLP99]) is the Unknottedness problem, namely testing if a knot diagram represents the trivial knot. A very different example is Shapley’s Stochastic Games, studied by Condon in [Con92], for which no efficient algorithm is known. On the other hand we have seen above that many problems first proved to be in N P ∩ coNP eventually were found to be in P. It is hard to generalize from such few examples, but the general belief is that the two classes are different. Conjecture 3.9. N P ∩ coN P 6= P. Note that this conjecture implies P= 6 NP, and is implied by conjecture 3.8. We now return to develop the main mechanism which will help us study such questions: efficient reductions and completeness.

3.6 Reductions: a partial order of computational difficulty In this subsection, we deal with relating the computational difficulty of problems for which we have no efficient solutions (yet). Recall that we can regard any classification problem (on finitely described objects) as a subset of our set of inputs I. Efficient reductions provide a natural partial order on such problems that captures their relative difficulty. We note that reductions were a primary tool in Computability and Recursion Theory, from which computational complexity developed. There, reductions were typically simply computable functions, whereas the focus of computational complexity will be efficiently computable ones. While we concentrate here on time efficiency, the field studies a great variety of other resources; limiting these in reductions is as rich as limiting them in algorithms. Definition 3.10 (Efficient reductions). Let C,D ⊂ I be two classification problems. f : I → I is an efficient reduction from C to D if f ∈ P and for every x ∈ I we have x ∈ C iff f(x) ∈ D. In this case we call f an efficient reduction from C to D. We write C ≤ D if there is an efficient reduction from C to D. The definition of efficient computation allows two immediate observations on the usefulness of efficient reductions. First, that indeed ≤ is transitive, and thus defines a partial order on classification problems. Second, one can compose an efficient algorithm for one problem and an efficient reduction from a second problem to get an efficient algorithm for the second. Specifically, if C ≤ D and D ∈ P then also C ∈ P. Formally, C ≤ D means that solving the classification problem C is computationally not much harder than solving D. In some cases one can replace computationally by the (vague) term mathematically. Often, such usefulness in mathematical understanding requires more properties of the reduction f than merely being efficiently computable (e.g. we may want it to be represented as a linear transformation, or a low dimension polynomial map), and indeed in some cases this is possible. When such a connection between two classification problems (which look unrelated) can be proved, it can mean the importability of techniques from one area to another. The power of efficient reductions to relate “seemingly unrelated” notions will unfold in later sections. We shall see that they can relate not only classification problems, but such diverse concepts as hardness to randomness, average-case to worst case difficulty, proof length to computation time, and last but not least, the security of electronic transactions to the difficulty of factoring integers. In a sense, efficient reductions are the backbone of computational complexity. Indeed, given that

41 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

C D

C¯ D¯

Figure 7: A schematic illustration of a reduction between two classiﬁcation problems

Algorithm for C

x Algorithm f(x) Algorithm yes/no for f for D

Figure 8: Composing a reduction and an algorithm to create a new algorithm polynomial time reductions can do all these wonders, no wonder we have a hard time characterizing the class P!

3.7 Completeness: problems capturing complexity classes We now return to classification problems. The partial order of their difficulty, provided by efficient reductions, allows us to define the hardest problems in a given class. Let C be any collection of classification problems (namely every element of C is a subset of I). Here we shall mainly care about the class C = NP. Definition 3.11 (Hardness and completeness). A problem D is called C-hard if for every C ∈ C we have C ≤ D. If we further have that D ∈ C then D is called C-complete.

In other words, if D is C-complete, it is a hardest problem in the class C: if we manage to solve D efficiently, we have done so for all other problems in C. It is not a priori clear that a given class has any complete problems! On the other hand, a given class may have many complete problems, and by definition, they all have essentially the same complexity. If we manage to prove that any of them cannot be efficiently solved, then we automatically have done so for all of them.

42 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

It is trivial, and uninteresting, that every problem in the class P is in fact P-complete under our definition. It becomes interesting when we find such universal problems in classes of problems for which we do not have efficient algorithms. By far, the most important of all such classes is NP.

3.8 NP-completeness As mentioned earlier, the seminal papers of Cook [Coo71] and Levin [Lev73] defined NP, efficient reducibilities and completeness, but the crown of their achievement was the discovery of a natural NP-complete problem. Definition 3.12 (The problem SAT ). A Boolean formula is a logical expression over Boolean variables (that can take values in {0, 1}) with connectives ∧, ∨, ¬ (standing for AND, OR, NOT), e.g. (x1 ∨ x2) ∧ (¬x3). Let SAT denote the set of all satisfiable Boolean formulae (namely those formulae for which there is a Boolean assignment to the variables for which the formula evaluates to 1). For example, the following formula is unsatisfiable

(¬x1 ∨ x2) ∧ (¬x2 ∨ x3) ∧ (¬x3) ∧ (x1 ∨ x3 ∨ x4) ∧ (¬x4 ∨ x1) while the one below is satisﬁable

(¬x1 ∨ x2) ∧ (¬x2 ∨ x3) ∧ (x1 ∨ x3 ∨ x4) ∧ (¬x4 ∨ x1).

We now arrive to a foundational theorem of computational complexity, revealing the primary importance of this simple looking problem of satisfying Boolean formulas. Theorem 3.13 [Coo71], [Lev73] SAT is NP-complete. We recall again the meaning of that statement. For every set C ∈ N P there is an efficient reduction f : I → I such that for every sequence z we have that z ∈ C iff the sequence f(z) encodes a satisfiable formula! The proof of this theorem, namely the construction of the reduction algorithm f, gives an extra bonus which turns out to be extremely useful: it maps witnesses to witnesses. Namely, given any witness y certifying that z ∈ C (via some verifier VC ), the same reduction f converts the witness y to a Boolean assignment to the variables of the formula f(z) which satisfy it. In other words, this reduction translates not only between the decision problems, but also between the associated search problems. Let us say a few words about the proof of Theorem 3.13. It is of course easy to see that SAT is in NP; a satisfying assignment is an easy to verify witness. The difficult part is proving the NP- hardness of SAT . Certainly the proof cannot afford to consider every problem C ∈ N P separately. The gist of the proof is a generic transformation, taking a description of the verifier VC for C, and emulating its computation on input z and hypothetical witness y to efficiently create a Boolean formula f(z) (whose variables are the bits of y). The formula constructed simply tests the validity of the computation of VC on (z, y), and that this computation outputs 1. Here the locality and simplicity of individual steps of algorithms (say, described as Turing machines) play a central role: checking the consistency of each step of the computation of VC amounts essentially to a constant size formula on a few bits. To summarize, SAT captures the difficulty of the whole class NP. In particular, the P vs. NP problem can now be phrased as a question about the complexity of one problem, instead of infinitely many.

43 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Corollary 3.14. P = NP iff SAT ∈ P. A great advantage of having one complete problem at hand (like SAT ), is that now, to prove that another problem (say D ∈ N P) is NP-complete, we only need to design a reduction from SAT to D (namely prove SAT ≤ D). We already know that for every C ∈ N P we have C ≤ SAT, and transitivity of ≤ takes care of the rest. This idea was powerfully used in the next seminal paper, of Karp [Kar72]. In his paper, he listed 21 problems from logic, graph theory, scheduling and geometry, and showed them to be NP-complete. This was the first demonstration of the wide spectrum of NP-complete problems, and initiated an industry of finding more. A few years later, Garey and Johnson [GJ79] published their book on NP-completeness, which contains hundreds of such problems from diverse branches of science, engineering, and mathematics. Today, thousands are known. We will soon discuss the meaning and importance of this notion, but first give some examples of NP-complete problems, and the nature of the connection between them.

3.9 Some NP-complete problems We stress again that all NP-complete problems are equivalent in a very strong sense. Any algorithm solving one can be simply translated into an equally efficient28 algorithm solving any other. We are finally ready to see the proof of Theorem 3.1 on the equivalence of our motivating examples from Section 8.1. It follows from the following three theorems. Theorem 3.15 [AM75] The set 2DIO is NP-complete. Theorem 3.16 [AHT06] The set KNOT is NP-complete. Theorem 3.17 [Kar72, Sto73] The set 3COL is NP-complete. Recall that to prove NP-completeness of a set, one has to prove two things: that it is in NP, and that it is NP-hard. In almost all NP-complete problems, membership in NP (namely the existence of short certificates) is easy to prove. Certainly, a candidate 3-coloring of a given map is short and easy to check. For 2DIO one can easily see that if there is a positive integer solution (x, y) to Ax2 +By +C = 0 then in fact there is short one29, indeed a solution whose length (in bits) is linear in the lengths of A, B, C. Thus, a short witness is simply a root (x, y). But KNOT is an exception, and the short witnesses for the knot having a small genus requires Haken’s algorithmic theory of normal surfaces, considerably enhanced (even short certificates for unknottedness in R3 are hard to obtain, see [HLP99]). Let us discuss what these NP-completeness results mean, first about the relationship between the three, and then about each individually. The proofs that these problems are complete follow by reductions from (variants of) SAT. The discrete, combinatorial nature of these reductions may cast doubt on the possibility that the computational equivalence of these problems implies the ability of real “technology transfer” between e.g. topology and number theory. Nevertheless, now that we know of the equivalence, perhaps simpler and more direct reductions can be found between these problems. Moreover, we stress again that reductions translate between witnesses as well. Namely, for any instance, say (M,K,G) ∈ KNOT, if we translate it using this reduction to an instance (A, B, C) ∈ 2DIO and happen (either by sheer luck or special structure of that equation) to find an integer root, the same reduction will translate that root back to a description of a genus G manifold which bounds the

28As usual, up to polynomial factors. 29Hint: if (x, y) is a root, so is (x + B, y − A(2x + B)).

44 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

knot K. Today many such NP-complete problems are known throughout mathematics, and for some pairs the equivalence can be mathematically meaningful and useful (as it is between some pairs of computational problems). Let us discuss the simplest of the three reductions above, namely from SAT to 3COL. If you have never seen one, it should be a mystery: the two problems talk about different worlds, one of logic and the other of graph theory. Both are difficult problems, but the reduction should be easy, namely efficiently computable. The key to this reduction, as well as almost any other, is the locality of computation! This of course is evident in SAT ; a formula is composed from Boolean gates, each of which performs a simple, local operation. However 3COL feels like a more global property30. The idea of this reduction is to focus on the individual gates of the input formula. We’ll find a reduction which works for each gate, and will compose the small (“gadget”) graphs produced mimicking the structure prescribed by the input formula. Let’s elaborate this idea. Here is how to transform the satisfiability problem for the (trivial, 1-gate) formula x ∨ y to a graph 3-coloring problem. We will actually transform the equation x ∨ y = z to a graph 3-coloring statement using the “gadget” graph in Figure9 below. Please check that it satisfies the following condition: in every legal 3-coloring of the graph above with colors {0, 1, 2}, the colors of the vertices labeled x, y, z will be from {0, 1}, that will satisfy the equation x ∨ y = z! One can easily construct such gadgets for the gates ∧, ¬ as well. Now, to complete the reduction the algorithm proceeds as follows. Given an arbitrary formula as input, it names its wires, builds a gadget graph for every gate, and identifies appropriate vertices in these to generate an output graph. By construction, it is 3-colorable if and only if the given formula was satisfiable. This is essentially the reduction in [Kar72], but we are not done yet: the gadget graph above is not planar (and hence the output graphs are not. . . ). However, Stockmeyer [Sto73] gives another gadget which can eliminate crossings in planar embeddings of graphs without changing their 3-colorability. The reader is encouraged to find such a gadget. With this, the proof is complete. We now list a few more NP-complete problems of a different nature, to give a feeling for the breadth of this phenomenon. Some appear already in Karp’s original article [Kar72]. Again, hundreds more can be found in Garey and Johnson’s book, [GJ79] and by now many thousands are known.

• Hamiltonian cycle. Given a graph, is there a simple cycle of edges going through every vertex precisely once?

• Subset-sum. Given a sequence of integers a1, . . . , an and b, is there a subset J such that P i∈J ai = b? • Integer programming. Given a polytope in Rn (by its bounding hyperplanes), does it contain an integer point?

• Clique. Given a graph and an integer k, are there k vertices with all pairs mutually adjacent? • Quadratic equations. Given a system of multivariate polynomial equations of degree at most 2, over a ﬁnite ﬁeld (say F2), do they have a common root? • Shortest lattice vector. Given a lattice L in Rn and an integer k, is the shortest nonzero vector of L of (Euclidean) length ≤ k?

30Consider e.g. a cycle on n vertices, where n is odd; it requires 3 colors, but if we remove any edge it can be 2-colored.

45 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

1 0

z z x x y

Figure 9: The gadget underlying the reduction from SAT to 3-COL.

3.10 The nature and impact of NP-completeness NP-completeness is a unique scientific discovery—there seems to be no precisely defined scientific notion which comes even close in pervading so many fields of science and engineering! We start with its most immediate impact, in computer science itself, move to mathematics and then to science and beyond. Some of this discussion will be become more meaningful (and impressive) as you read further through the book, and in detail in the last chapter. More can be found e.g. in Papadimitriou’s retrospective on the subject [Pap97]. Curiously, that paper reports that electronic search (new at the time) revealed thousands of science and math papers with the phrase NP-complete in them; today, 20 years later, this number is in the millions! As mentioned, starting with Karp’s paper [Kar72], an explosion of NP-completeness results followed quickly within every corner and subfield of CS. This is easy to explain. Most of the field of computer science and industry, from academics to programmers, are busy seeking efficient algorithms for numerous computational problems. How can one justify failure to find such an algorithm? In the absence of any techniques for proving intractability, the next best thing was proving that the computational problem at hand was NP-complete (or NP-hard), which means that finding such an efficient algorithm for it would imply an efficient algorithm for numerous others, which many others failed to solve. In short, failing to prove P = NP is a very powerful excuse, and NP-completeness is an excellent stamp of hardness. Every professional of the field knows this! While NP-completeness is a negative result (basically showing that what we want is impossible), such negative results had a positive impact. As problems do not go away when you declare them NP-complete, and still demand solutions, weaker solution concepts for them were

46 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

developed. For example, for optimization problems, people attempted to find good approximation algorithms. Moreover, given that NP-completeness only captures worst-case hardness, people developed algorithms which work well “on average”, and heuristics which seem to work well on inputs which “show up in practice”. A variety of quality criteria and models were developed for such relaxations, leading to analogous complexity theories which enable to argue hardness as well; some of these will be discussed later in the book. The next field to be impacted by NP-completeness was mathematics. With some delay, NP- completeness theorems started showing up in most mathematical disciplines, including algebra, analysis, geometry, topology, combinatorics, number theory and more. This already may seem more surprising, as most questions mathematicians are asking themselves are not algorithmic. However, existence theorems for a variety of objects beg the question of having “explicit” descriptions of such objects. Moreover, in many fields one actually needs to find such objects. Mathematics is full of a variety of constructions, done by hand long ago and by numerous libraries of computer programs that are essential for progress, and hence so is their efficiency. Like computer scientists, mathematicians adopted the notion of polynomial-time algorithm as a first cut at “efficient” and “explicit”. Thus description and construction problems which are NP-complete were extremely useful to set limits on the hopes of achieving these. Furthermore, in mathematics, such NP- completeness results meant an underlying “mathematical nastiness” of the structures under study. For example, as we explained in Section 3.5, an efficient characterization of a property which is NP-complete will imply that NP = coNP, and so it is unlikely (as we understand things today) that such a characterization exists. As in CS, in math as well such bad news begets good outcomes, setting mathematicians in more productive directions refining or specializing the properties under study, considering a variety of approximate notions etc., or simply being satisfied with sufficient and necessary conditions which are not complementary as needed for characterization. The presence and impact on NP-completeness in science is evidenced by the fact that such results (which are patently about computation) in biology, chemistry, economics, neuroscience, electrical engineering and more are being proved not by computer scientists, but by biologists, chemists, economists, neuroscientists, electrical engineers, etc. Moreover, these results are being published in scientific journals of these very fields. And the numbers are staggering; a search for papers which contain the phrase “NP-complete” or NP-completeness” prominently (in the title, abstract or keywords), reveals that in each such discipline there are hundreds such papers, and many thousands more which mention them in the body. To obtain such results, all these thousands of scientists needed to learn the concepts and proof methods of computational complexity, typically a foreign language to most (let alone that mathematical theorems rarely appear in science articles at all). This phenomenon begs an explanation! Indeed, there are two questions to answer. What explains the abundance of NP-completeness in these diverse disciplines, and why do their scientists bother making the unusual effort to prove these computational theorems? One important observation is that scientists often study processes, and try to build models which explain and predict these. Almost by definition, these are computational processes, namely composed of a sequence of simple, local steps, like Turing machines, albeit manipulating not bits in computers but possibly neurons in the brain, proteins in the cell, atoms in matter, fish in a school or stars in a galaxy. In other words, many models simply describe algorithms which nature uses for generating certain processes or behavior. A typical NP-completeness result often refers to the limits of prediction from a particular model of some natural process. Here are some illustrative examples. In some existing models it is NP-complete to compute the following quantities: the

47 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

minimal surface area a given foam will settle into (in physics), the minimal energy configuration of a certain molecule, e.g. as in protein folding (in biology), the maximum social welfare of certain equilibria (in economics), etc. Let’s explore the meaning of such results. Assuming P= 6 NP, NP-completeness means that no efficient algorithm can compute the required quantities (e.g. in the examples above), at least for some instances. Further, assuming that natural processes are inherently efficient algorithms, this seems to suggest at least one of two possible conclusions. One possibility is that the model is simply wrong (or incomplete), and the other is that the “hard” instances simply never occur in nature31. In both cases, NP-completeness calls for a better understanding, e.g. refinement of the model at hand, a characterization of the instances for which the algorithm suggested by the model solves efficiently (and an argument that these are consistent with what we see in nature), etc. This idea has caused some researchers to propose that our underlying conjecture, P= 6 NP, should be viewed as a law of nature! Perhaps the first explicit such occurrence is this quote32, from Volker Strassen’s laudation [Str86] for Les Valiant on his Nevanlinna Prize: “The evidence in favor of Cook’s and Valiant’s hypotheses is so overwhelming, and the consequences of their failure are so grotesque, that their status may perhaps be compared to that of physical laws rather than that of ordinary mathematical conjectures.”. Note that at that time, the utility of this mathematical conjecture to science was not as well understood as it is today. Still, how to precisely articulate this mathematical statement as a relevant law of nature is of course interesting to debate. An intuitive desire is to let it play the same role that the 2nd law of thermodynamics plays in science: scientists would be extremely wary to propose a model which violates it. One suggestion, by Scott Aaronson, is a stronger statement about the real world: There is no physical means to solve NP-complete problems in polynomial time. A host of possible physical means which were actually attempted is exposited in [Aar05]. There is still the mystery of the ubiquitous presence of NP-completeness in practically every subfield of CS, Math, and essentially all sciences. With hindsight, this is an amplified (and much more relevant) incarnation of the ubiquity of undecidability in all these disciplines. Both are explained by the fact that computation, viewed as above as any process evolving via a sequence of simple, local steps, is so abundant. Similarly, descriptions of properties of systems with many parts (either desired properties, or observed properties, which are typically the outcomes of such computations) are often given, or modeled, by sets of simple, local constraints on small subsystems of the whole. As it happens, for almost all choices of constraints, their mutual satisfaction for given instances is undecidable if the system is infinite, and is NP-complete if finite. In much rarer case, they lead to (respectively) decidable or polynomial time solvable problems. Understanding these phenomena, and delineating the types of constraints across the tractable/intractable barrier, is an active field of study, and will be discussed further in Section 4.3. Concluding this somewhat philosophical section, we note another major impact of NP-completeness. Namely, that it served as a role model for numerous other notions of computational universality. NP-completeness turned out to be an extremely flexible and extendible notion, allowing numerous variants which enabled capturing universality in other (mainly computational, but not only) contexts. It led to the definitions of classes of problems solvable using very different resource bounds, and in most cases, also these classes were shown to have complete problems, capturing the difficulty

31E.g. it is quite possible that in billions of years of evolution only proteins which are easily and eﬃciently foldable survived, and others became extinct. 32In this quote Cook’s hypothesis is P 6= NP, and Valinat’s hypothesis is what became known as VP 6= VNP which we will discuss in Chapter 12.

48 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

of the whole class under natural reductions, with the benefits described above (some examples will be discussed in Section 4.1 and then in later chapters). Much of the whole evolution of computational complexity, the theory of algorithms, and most other areas in theoretical computer science has been guided by the powerful approach of reduction and completeness. This has generated multiple theories of intractability in various settings, and tools to understand and possibly curb or circumvent it (even though we are still mostly unable to actually outright prove intractability in most cases). The structures revealed by this powerful methodology send an important message to other disciplines. We feel that the strongest impact of this message will be to the sciences; this will be elaborated on in great detail in the final Chapter 20, and summarize it here in one paragraph. The discussion in this chapter suggests integrating computational complexity aspects into every model of natural processes. Namely that scientists will account not only for the mechanism by which things evolve, and the way in which physical quantities are affected, but also for the amounts of relevant computational resources expanded in that evolution. Doing so will add constraints that may guide scientists to better models which nature can actually “carry out”. When taking computational constraints into account in scientific models becomes standard practice it would mean a revolutionary shift in the way science is done. While such a paradigm shift will take time to propagate across science, it is in the works! The above mentioned occurrence of NP-completeness in so many scientific papers is just a beginning, and illustrates both the importance of complexity to science and the willingness of scientists to embrace it. But beyond this, in more and more works (indeed primarily collaborative works of computer scientists with scientists in other fields), we see models which integrate the computational aspects into the description of natural processes, and how this can lead to radically new scientific insights. We list a few books, surveys and articles which represent this trend in various disciplines [NRTV07, Val13, Val00, EK10, Pap14, Kar11, CLPV14, HH13] and many others. By way of example, the last paper, by physicists, offers a complexity-theoretic based explanation that is possibly the only way out of the famous “Black hole firewall paradox”. Much more on these exciting developments can be found in Chapter 20.

4 Problems and classes inside (and “around”) NP

This chapter touches on different aspects and variants of the P vs. NP question studied in computational complexity, the resulting complexity classes in the “neighborhood” of these two main ones, and the central questions about them. The first brief section lists a few types of problems which are not classification problems, leading mostly to classes containing NP. The remaining sections are devoted to problems and classes in the potentially vast universe between the easiest and hardest problems in NP, namely between P and NPcomplete. We discuss degrees of intermediate complexities of problems in this universe, as well as constraint satisfaction problems (CSPs) for which there may be no such middle ground. The last two sections discuss the same universe from another perspective, motivated by “average-case” analysis of computational complexity as well as the more stringent computational needs of cryptography.

4.1 Other types of computational problems and associated complexity classes There are many other types of computational problems which do not fall into the class NP, that arise naturally and are studied intensively in both theory and practice. Some of the most natural

49 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

types are • Optimization problems. Fix an NP problem, and a cost function on solutions (witnesses). Given an input, find the best solution for it (e.g. find the largest clique, the shortest path, the minimum energy configuration, etc.). A natural relaxation of optimization problems asks for an approximation, namely to find a solution which is “close” to the best one. A complexity theory allowing the understanding of the limits of efficient approximation has been one of the most exciting developments in computational complexity, starting with the PCP Theorem 10.6. These are discussed in Sections 4.3 and 10.3. • Quantified problems. A complete set for NP (which characterizes it via reductions) is SAT , namely the set of all formulae F in variables x for which ∃x F (x). Similarly, a complete set for coNP is the set of all formulae F in variables x for which ∀x F (x). Generalizing from these examples, by allowing alternation of several quantifiers (and sets of variables), as is done for example in first order logic, one obtains new complexity classes. For example the set of formulas F in variables x, y satisfying ∃x ∀y F (x, y), and use it to define a class (called Σ2) of all problems efficiently reducible to it (if this reminds you of Chess puzzles of the form “White to mate in 2 moves”, you have the right intuition). The class Π2 is similarly defined by formulae F satisfying ∀x ∃y F (x, y). These naturally extends to to classes Σk, Πk for any fixed natural number k (with NP = Σ1, coNP = Π1, and naturally P = Σ0 = Π0 when there are no quantifiers), with the obvious inclusions (Σk ⊆ Σk+1,Πk ⊆ Πk+1). While in first order logic it is a theorem that each additional quantifier strictly adds descriptive power, the analog in computational complexity (e.g. Σk 6= Σk+1) is only a conjecture (extending P 6= NP). The complexity class which is the union over k of all these classes is called the Polynomial Hierarchy, denoted PH. Its study was initiated by Stockmeyer in [Sto76]. • Counting problems. Fix an NP problem. Given an input, find the number of solutions (witnesses) for it. Many problems in enumerative combinatorics and in statistical physics fall into this category. Here too, a natural relaxation of counting problems is approximation: computing a number which is “close” to the actual count. The natural home of most of these problems is a class called #P. A most natural complete problem for this class is #SAT , which asks to compute the number of satisfying assignments of a given formula (more generally, counting versions of typical NP-complete classification problems are #P complete). A remarkable complete problem for it, is evaluating the Permanent polynomial33, or equivalently counting the number of perfect matchings of a given bipartite graph. Thus, even counting versions of easy classification problems (e.g. testing if a perfect matching exists) can be #P-complete. This discovery, the definition of the class #P and the complexity theoretic study of enumeration problems originates from Valiant’s papers [Val79a,Val79c]. A surprising, fundamental result of Toda [Tod91] efficiently reduces quantified problems (above) to counting problems (in symbols, PH ⊆ P#P ). • Strategic problems. Given a (complete information, 2-player) game, find an optimal strategy for a given player. Equivalently, given a position in the game, find the best move. Many problems in economics and decision theory, as well as playing well the game of Chess, fall into this category. The natural home for most of these problems is the class PSPACE of problems solvable using a polynomial amount of memory (but possibly exponential time),

33A sibling of the Determinant, which will be discussed in Chapter 12.

50 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

and indeed many such games (appropriately extended to families of games of arbitrary sizes, to allow asymptotics, and restricting the number of moves to be polynomial in “board size”) become complete for PSPACE. This characterization of the basic memory (or space) resource in computation in terms of alternation of quantifiers (namely, as game strategies) arises as well from [Sto76], and obviously extends the bounded alternation games described above (which defined PH). A major, surprising understanding of polynomial space is the result IP = PSPACE of [Sha92]. It establishes PSPACE as the home of all problems having efficient interactive proofs (an important extension of “written proofs” captured by NP) that is discussed in Section 10.1. • Total NP functions. These are search problems seeking to find objects which are guaranteed to exist (like local optima, fixed points, Nash equilibria), and are certified by small witnesses. In many such problems, the input is an implicitly defined34 exponentially large graph, (possibly weighted, possibly directed). The task is finding a vertex with some simple property, whose existence is guaranteed by a combinatorial principle. For example, that every directed acyclic graph has a sink (and so the task is finding one), or that every undirected graph has an even number of vertices of odd degree (and so the task is, given one such vertex, find another). In the paper initiating this study, Papadimitriou [Pap94] defines several complexity classes, each captured by one such principle. These classes lie between (the search problems associated with) P and NP. One important example is the class PLS, for polynomial local search, in which a complete problem is finding a local minimum in a weighted directed graph. Another is the class PPAD, for which a natural complete problem is (a discrete version of) computing a fixed point of a given function. Computing Nash equilibrium in a given 2-player game is clearly in this class, as the proof of Nash’s theorem (that every game has such an equilibrium) follows simply from Brouwer’s fixed point theorem. A major result [DGP09, CDT09] was proving the converse, establishing that finding a Nash equilibrium is a complete problem for this class! These classes of problems and their complexity were studied in [BCE+95] through the framework of Proof Complexity, a subject we will discuss in Chapter6. The following figure, Figure 10 shows some of the known inclusions between these classes, and some problems in them. Note that despite the fact that SAT and CLIQUE are NP-complete, while P erfectMatching is in P, their counting versions are all in #P, and indeed all three are complete for this class (Permanent is the counting problem for perfect matchings). We shall not elaborate on these families of important problems and classes here. Some of them will be mentioned in subsequent sections, but we will not develop their complexity theory systematically. We remark that the methodology of efficient reductions and completeness illuminates much of their computational complexity in the same way as for classification problems.

4.2 Between P and NP We have seen that NP contains a vast number of problems, but that difficulty-wise nearly all of those we have seen fall into one of two equivalence classes: P, which are all efficiently solvable, and NP-complete. Of course, if P = NP the two classes are the same. But assuming P= 6 NP, is there anything else? Ladner [Lad75] proved the following result: Theorem 4.1 [Lad75] If P= 6 NP, then there are infinitely many levels of difficulty in NP. More precisely, there are sets C1,C2,... in NP such that for all i we have Ci ≤ Ci+1 but Ci+1 6≤ Ci. 34E.g. via a program computing the neighbors of any given vertex.

51 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

PSPACE F CHESS #P F Permanent F #SAT F #CLIQUE PH

F Circuit Minimization

NP F SAT F CLIQUE P

F Perfect Matching

Figure 10: Between P and PSPACE. As far as we know, all these classes may be equal!

So, there is a lot of “dark matter” between P and NP-complete. But are there any natural decision35 problems which fall between these classes? We know only of very precious few candidates; those on the list below, some of which were also discussed in Section 3.5, and a handful of others. We discuss each in turn after listing them.

• Integer factoring. Given an integer, ﬁnd its prime factors (a decision version might ask for the ith bit of the jth prime). • Stochastic games. Three players, White, Black, and Nature move a token on a directed graph, whose vertices are labeled with player’s names. At every step, the token can be moved by the player labeling the vertex it occupies to another along an edge out of that vertex. Nature’s moves are random, while White and Black play strategically. Given a labeled graph, and start and target nodes for the token, does White have a strategy which guarantees that the token reaches the target with probability ≥ 1/2? • Knot triviality. Given a diagram describing a knot (see e.g. Figure1), is it the trivial knot?

• Approximate shortest lattice vector. Given a (basis for a) lattice L in Rn, and an integer k, does the shortest vector of L have (Euclidean) length at most k, or at least kn? (it is guaranteed that this minimum length is not in [k, kn])

35We discussed search problems in this gap in the previous section.

52 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• Graph isomorphism. Given two graphs, are they isomorphic? Namely, is there a bijection between their vertices which preserves the edges?36 • Circuit minimization The notions appearing in this problem description will be formalized in Chapter5. Intuitively, it asks for the fastest program computing a function on ﬁxed sized inputs. More formally, given a truth table of a Boolean function f, and an integer s, does there exist a Boolean circuit of size at most s computing f? Some evidence of the “intermediate status” of this problem can be found in [AH17] and its references.

Currently we cannot rule out that efficient algorithms will be found for any of them, and so some may actually be in P. But we have good formal reasons to believe that they are not NP- complete. This is interesting; we already saw that if a problem is NP-complete, it is an indication that it is not easy (namely, in P), if we believe that P= 6 NP. What indication can we have that a problem is not universally hard (namely, is not NP-complete)? Well, if for example the problem is in N P ∩ coNP, and we believe N P 6= coNP, then that problem cannot be NP-complete. In both arguments above, unlikely collapses of complexity classes (P = NP and NP = coNP above) gives us (perhaps with different confidence) an indication as to the complexity of specific problems. This is somewhat satisfactory, in the absence of a definite theorem about their complexity. In particular, we can now explain better why the problems above are not likely to be NP-complete. The first four problems are all in N P ∩ coNP. This is clear for (the decision problem of) factoring. For stochastic games, this is proved in [Con93]. The lattice problem was resolved by [AR05]. The knottedness problem is special in that it is a rare example where both inclusions are highly nontrivial. Membership in NP was proved in [HLP99] (and again, very differently, in [Lac15]). Membership in coNP was first proved conditionally on the Generalized Riemann Hypothesis (GRH) in [Kup14]37, and only recently a different proof was given in [Lac16] which requires no unproven assumption. Graph isomorphism, while in NP, is not known to be in coNP, and so we cannot use the same logic to rule out its possible NP-completeness directly. However, one can apply very similar logic. Graph non-isomorphism has a different type of “short, efficient proof”, called interactive proof, discussed in Section 10. Using this one can prove that if graph isomorphism is NP-complete, this would yield a surprising collapse of the polynomial time hierarchy PH (defined in Section 4.1). Of course, with the recent quasi-polynomial-time algorithm for graph isomorphism [Bab15] mentioned above, we have much better reasons to believe that it cannot be NP-complete. The last problem, circuit minimization (which has several variations) is even more mysterious than the ones above. Numerous papers have been written on “unlikely” consequences of its possible easiness (being in P) and its possible hardness (being NP-complete). A recent survey on the topic is [All17]. Finding other natural examples (or better yet, classes of examples) like these will enhance our understanding of the gap NP\P. Considering the examples above, we expect that mathematics is a more likely source for them than, say, industry. However, for some large classes of natural problems, we know or believe that they must exhibit this dichotomy; every problem in the class is either in P or is NP-complete. These are classes of CSPs (constraint-satisfaction problems), which we describe next. 36The recent breakthrough of Babai [Bab15] gives a quasi-polynomial-time algorithm for this problem (namely of complexity roughly exp((log n)O(1))), bringing it very close to P. 37It may seem mysterious what the GRH has to do with knots, and I encourage you to look at the paper to find out.

53 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

4.3 Constraint Satisfaction Problems (CSPs) A host of natural problems can be cast as satisfying a large collection of “constraints” on a set of variables. Solving a system of linear equations or of polynomial equations over some field, satisfying a Boolean formula and coloring a graph are a few of many examples. Here we will be interested in local and uniform collections of constraints. Locality means that each constraint is on a constant number of variables. Uniformity means that all constraints are of the same type. For example, in 3-coloring of planar maps, the variables correspond to the intended colors of the regions (each can take one of three values, say Red, Green, Blue), and each pair of adjacent regions dictates one constraint: that the colors of these two must be different. Let us give a more formal definition. Fix arity k (the locality parameter), alphabet Σ (possible values to the variables) and a relation R ⊆ Σk, (defining the set of tuple values satisfying the constraint) we denote by CSP(k, Σ,R) the following computational problem. Given a collection of k-tuples from a set of n variables, is there an assignment of the variables from Σn which satisfies all constraints (namely the value assigned to each given tuple is in the relation R). These are CSPs with one relation. More generally, one can allow several relations instead of one, and we refer to all as CSPs. For example, for graph 3-coloring, there is a single (2-ary) relation (a 6= b) over the alphabet [3] of three colors (formally, this relation contains the three pairs R3col = {(1, 2), (1, 3), (2, 3)}). An instance of the problem CSP(3,R3col) is a collection of such constraints (xi 6= xj) over n variables that can take any of these 3 values. The pairs appearing in the constraints are the edges in this n-vertex graph. For another example, consider the 3−SAT problem of Boolean satisfyability. Here one needs to introduce 8 3-ary relations, one for each of the 8 literal combinations of negating or not the variables in a single clause (e.g. (a ∨ b ∨ c), (¯a ∨ b ∨ c), etc.). An instance of this problem is a collection of constraints of this form over n variables xi taking Boolean values in {0, 1}. Namely, it is a standard 3 − SAT instance. A bold conjecture of Feder and Vardi [FV98], called the Dichotomy Conjecture, asserts that for this vast set of problems there are no intermediate levels of complexity of the type of Ladner’s theorem from the previous subsection—each CSP is either in P or else is NP-complete. Conjecture 4.2 (Dichotomy Conjecture). [FV98] Every CSP is either in P or is NP-complete. This conjecture was proved by Schaefer [Sch78] for the subclass of all CSPs on binary alphabets. His proof actually characterizes which constraints (namely, relations) give rise to easy CSPs and which yield hard ones. Further work by Bulatov and Jeavons on the general case [BJ01] seeks such characterization in terms of a certain algebraic property of the relations defining each particular CSP. This property can distinguish e.g. between linear equations and disjunctions, making the first CSP easy (in P) and the second hard (is NP-complete). Observe that such characterizations require developing meta-algorithms in the easy case, and meta-reductions for proving hardness, as they derive each type of result simultaneously for infinitely many CSPs. This algebraic program was carried through for relations on ternary alphabets by Bulatov [Bul06], proving the conjecture also in this case. Finally, as this book goes to print, proofs of the full dichotomy conjecture were announced by Bulatov [Bul17]! There is a variety of extensions of CSPs and questions about them. For example, one can be interested in counting the number of satisfying assignments (rather than existence of one). An extensive theory was developed where strong dichotomy theorems (now between P and #P- completeness) can be proved – see the results and historical account in the paper of Cai and Chen [CC12]. Another question is about maximizing the number of satisfied constraints (especially

54 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

when not all can be satisfied) - we will discuss this direction at some length now. We note that in Section 11.2, we will see that quantum Hamiltonians constitute an analog of the above “classical” CSPs which arises naturally in physics, and in which natural computational complexity questions about proofs, approximations, dichotomy etc. arise. Another natural question to ask about CSPs is efficiently finding good approximate solutions, namely assignments to the variables which satisfy many of the given constraints. For example, in the graph 3-coloring problem mentioned above, it is very easy to satisfy 2/3 of the edge constraints (note that a random coloring would do so on average38). We also know that satisfying all of them is NP-hard. What is the best approximation ratio achievable efficiently? E.g., can we get 99%? The huge mathematical field of optimization studies such questions (not only for CSPs), seeking efficient algorithms which produce good approximate solutions to problems for which the optimum is hard to find. For decades it was not known how to argue that hardness (say, NP-hardness) of approximation problems as the one above for 3-coloring. This changed dramatically with the revolution of the PCP Theorem 10.6, discussed in Section 10.3. This theorem and subsequent developments enabled not only proving such hardness results for many problems, but for some even pinpointing precisely the limits of efficient approximation. For example, while satisfying 1/2 fraction of a given set of linear equations modulo 2 is in P (find such an algorithm!), satisfying 1/2 + fraction (for any > 0) turns out to be NP-hard! That there is such a sharp transition in complexity for this problem may seem extremely surprising. However, a similar dichotomy conjecture says that for every CSP this is the case! The truth of this conjecture seems to hinge on the following remarkable computational problem which we would like to highlight. Its NP-completeness status (is it, or is it not?), and more generally its exact computational complexity, has been both the most intriguing and most important in the past decade. This problem was suggested by Khot [Kho02], who called it (for a reason) the Unique Games problem. We now explain the problem, and touch on why it is so central. Section 10.3 will discuss the surprising origins of this problem. Unique Games: Fix > 0 and integer m. The problem UG(, m) is the following. Given a system of linear equations in n variables x1, x2, . . . , xn over Zm, with two variables per equation, answer ‘yes’ if there is an assignment satisfying a fraction 1 − of the equations, and answer ‘no’ if no assignment satisfies more than a fraction of them (any answer is acceptable if neither of these is the case)39. Observe that every unique games problem is a simple CSP (with m3 relations, one for each a, b, c ∈ Zm, each a linear constraint on pairs of variables of the form a · xi + b · xj = c). In his paper, Khot conjectured that this problem is NP-complete. It is commonly called the Unique Games Conjecture. Conjecture 4.3 (UGC). [Kho02] For every > 0 there exists a m such that UG(, m) is NP-hard. Note that the UG problem may be viewed as an approximation problem—to solve the problem, it suffices to approximate the maximum number of satisfied equations to within a factor smaller than (1 − )/. This will distinguish the ‘yes’ and ‘no’ instances. Khot proved that improving certain approximation algorithms for some well studied problems is at least as hard as solving the UG problem. Since his paper many more such reductions were discovered. The Unique Games problem seems to be a new type of a complete problem, capturing limits of efficient approximation in many settings. This point was driven home powerfully when Raghavendra [Rag08] proved that, assuming UGC, there is a single, simple efficient meta-algorithm (based on semi-definite programming), which

38Try ﬁnding an eﬃcient algorithm that will produce one. 39Such a problem is called a “promise problem”, where algorithms can err on instances not satisfying the “promise”.

55 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

for every constraint satisfaction problem, achieves the best possible approximation ratio unless P = NP. Note that Raghavendra’s result may be stated as a (conditional) dichotomy theorem. Theorem 4.4 [Rag08] Assume UGC. Then, for every CSP there is a constant ρ, such that approximating it to within approximation ratio ρ is in P, but approximating it to any better ratio ρ + is NP-hard for every > 0. It is probably fair to say that, unlike most conjectures in this book, there is no similar consensus about the truth of UGC. Regardless, the study of UGC turned out to be a surprising source of problems in analysis, geometry, probability and more. For more on this problem, conjecture and connections, see [Kho10, O’D14].

4.4 Average-case complexity It is important to stress that the “worst-case” analysis of algorithms, which we adopted throughout (looking at the time to solve the worst input of each length), is certainly not the only interesting complexity measure (and not the only one studied). Often “average-case” analysis, focusing on “typical” complexity of algorithms, is far more interesting to study. After all, solving a hard problem most of the time may suffice in some applications. Thus analyzing algorithms for given problems under specific natural input distributions (e.g. how they perform on average, or with high probability) is a large, important field, which was, and is taken in earnest by the theory of algorithms and computational complexity. Some general approaches to modeling such “typical” distributions and developing algorithms for them include probabilistic analysis of algorithms [Kar76], semi-random models [FK01], smoothed analysis [ST04b] stable instances [BL12,BBG13], input distributions with certain moment bounds [HS17, KS17], and many others. We elaborate some more on this effort, and the challenge of understanding of heuristics, in Section 20.7.2. But the truth is that typically, in most practical applications, very little if anything is really known about the input distribution. Problem instances are generated by nature or people, and their distribution (or even support) is hard to pin down. To see this consider the set of genomes and proteins processed by molecular biology algorithms, or the set of signals from outer space processed by astrophysical algorithms, the set of search requests processed by Google. . . or even the set of mathematical structures that working mathematicians play with when contemplating a problem (e.g. the problems in the beginning of Chapter2). Can one classify all “natural” input distributions? How should one construct a successful complexity theory for this “average-case” setting? Can all NP-complete problems be easy “on average”? How should we formally define easy and hard problems in this distributional setting, and how do we compare the relative difficulty of distributional problems? These highly nontrivial questions were first tackled by Levin [Lev86], and better understood in his follow-up work with Impagliazzo [IL90]. We explain some of the main definitions of Levin’s theory and their subtleties. The reader will hopefully get a sense of the power of the methodology introduced earlier of classification, reductions and completeness, as well as some difficulties which may arise when applying this methodology in new settings. As input distributions are not known in advance, it makes sense to consider here distributional problems. These have the form (C,D), where C ⊆ I defines a property (or classification problem) as before, and D is a probability distribution on I according to which inputs are chosen. Next on the agenda is to define the class of easy distributional problems, which we call distP, as those having fast algorithms “on average”. This definition presents a significant challenge. Recall that the class P of easy worst-case problems enjoyed strong robustness properties (e.g. it is invariant under polynomial

56 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

changes to the model or to data representations). This desirable property is hard to guarantee in the distributional setting. Taking the obvious definition of average polynomial time, namely when the expected run-time of an algorithm under the given distribution grows polynomially with input length, doesn’t work. This expected value can vary between polynomial and exponential under e.g. quadratic change of input size, or quadratic change of run-time per input. Levin overcomes this by using a clever, non-standard notion (which we skip here) of what it means for an algorithm to solve a problem C on input distribution D in average polynomial time. The class distP of “easy” problems on average is then defined as the set of all distributional problems (C,D) possessing such an algorithm. Next, with one eye towards applications of the theory, and another towards identifying complete distributional NP problems, (that are as hard as all others), one has to judiciously choose the set of allowed input distributions to consider. It is not hard to see that it is hopeless to allow all distributions. But on the other hand one would like the theory to include all reasonable distributions that can actually occur, like the natural and man-made examples mentioned above. The right choice turns out to be the efficiently sampleable distributions. A probability distribution is efficiently sampleable if it is the output distribution of any efficient algorithm which takes as input independent unbiased coin-tosses (roughly, the uniform distribution on sequences of each given length). This is an extremely broad class of probability distributions! Indeed, assuming Nature does not perform computationally intractable tasks, this covers all distributions that algorithms will ever face. Once this choice is made, the distributional analog distNP of NP can simply be defined as all pairs (C,D) with C ∈ N P and D an efficiently sampleable distribution. It remains to define reductions and completeness. These are natural enough; the definition used in the worst-case setting suffices, as any mapping on instances f : I → I naturally extends to a mapping on distributions. But are there any complete problems, and even more, are there natural ones? Note that for (C,D) to be a complete problem, the distribution D must “capture” all other efficiently sampleable ones! This raises formidable technical challenges, which Levin overcomes, proving that a certain distributional version of the plane tiling problem is complete for distNP. Since Levin’s original paper 30 years ago, precious few other reasonably natural complete problems were found. It remains a challenge to exhibit a truly natural complete problem; perhaps one of the NP-complete problems under the uniform distribution, or one of the problems arising in statistical mechanics (like the Ising model) under the natural Gibbs distributions. Clearly, if P = NP then distP = distNP. Perhaps the most outstanding problem in this area is about the converse: does natural worst-case hard problems imply the existence of natural average-case hard ones. Namely Open Problem 4.5. Does P= 6 NP imply that distP= 6 distNP? The reader can find more detail on this fascinating subject by Impagliazzo in [Imp95b], and by Goldreich in [Gol97].

4.5 One-way functions, trap-door functions and cryptography There is no better demonstration of the power of computational complexity ideas and methodology to completely transform the world we live in than the story of cryptography. We tell it very brieﬂy, focusing on the special types of “hard on-average” functions which underlie it. Numerous popular and technical texts expound this cryptography, and we recommend Goldreich’s books [Gol04] for a comprehensive development of its theoretical ideas. We also devote a chapter to it later in the book, Chapter 18.

57 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Let us first motivate one-way functions describing the actual application that led to it, a password scheme from the 1960s due to Needham (described by Wilkes in [Wil75, p. 91]). Believe it or not, access control has not changed much since then. A typical system asks the user for two pieces of information, login and password. Assume (without much loss in generality) that both are sequences of some length n, and that the login of user i is simply the number i. Every user secretly picks (at random or in any other way) a password xi. Thus, if you type (i, xi) (for any i whatsoever) then the system should let you in, and otherwise shouldn’t. The main question is, how should the system store the passwords of its users? Certainly, it can store all pairs (i, xi) in a protected system file (and whenever a user enters (i, z), check if z = xi). But even in the 1960s, hackers broke into systems, and so a better solution was sought. Needham suggest a way that will avoid altogether the need to hide the password file, as follows. Fix a function f : I → I. The information stored in the password file would be pairs (i, yi), with yi = f(xi). Now let us see what properties f should have to make this a good system. For one, it must be easy to compute f on any input x. After all, checking that (i, z) is legal now requires the system to check if f(z) = yi. On the other hand, having access to the pairs (i, yi) should help no one to figure out xi for any i. In particular, f must be hard to invert: given f(x) it must be hard to obtain x (or any other pre-image of f(x) if such exists). This should at least hold with high probability over a uniform random choice of x (and the system should recommend that users pick their passwords at random). Thus, we arrived at the definition of one-way functions, put forth by Diffie and Hellman in their prescient, superbly written paper [DH76] as a foundation stone of their revolutionary theory of complexity-based cryptography. It is a function that is easy to compute, but hard (on average) to invert.

Deﬁnition 4.6 (One-way function). A function f : I → I is called one-way if f ∈ P, but for every eﬃcient algorithm A, its probability of computing any pre-image of f applied to a random input is small. Namely, for every (large enough) n,

Pr[f(A(f(x))) = f(x)] ≤ 1/2 where the probability is taken over the uniform distribution of n-bit sequences x. Stated differently, the algorithm A is fed y = f(x) for a random x, and should fail with high probability to produce any inverse of y. Our choice of 1/2 above as an upper bound on the inversion probability is arbitrary; as it happens, picking any bound in the range [exp(−n), 1 − 1/n] would yield an essentially equivalent definition (via amplification of this probability via repetitions—an idea we will meet in the sections on randomness). Let us meet Diffie and Hellman’s suggestion (actually, they credit it to John Gill) for a one-way function, Modular Exponentiation, based on the assumed hardness of Discrete Logarithms. ∗ Let p be a prime, g a generator of Zp, and define MEp,g : {1, 2, . . . , p − 1} → {1, 2, . . . , p − 1} by x−1 MEp,g(x) = g mod p, the modular exponentiation function modulo p (and note that it is actually 40 a permutation). Note that computing MEp,g is easy on every input (via repeated squaring ). It is believed that for primes p for which p − 1 has few factors (e.g. p − 1 = 2q with prime q), 41 computing the inverse of MEp,g (namely, the discrete logarithm modulo p) is exponentially hard ,

i 40Namely, computing all powers g2 mod p with i ≤ log p. 41As a function of the input length, which is roughly log p bits.

58 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

even on average (many efforts to find better algorithms in the past decades have not refuted this belief). One can “glue” all these permutations (in several natural ways) into a single permutation ME : I → I, the Modular Exponentiation permutation, and conjecture: Conjecture 4.7. The Modular Exponentiation function ME is a one-way function. How is this conjecture related to the complexity classes we have already met? As it requires hardness on average, it implies that distP= 6 distNP. Indeed, the existence of any one-way function will imply that! Moreover, as ME is a permutation it implies that N P ∩ coN P 6= P42. Indeed, any one-way permutation will imply that. These connections hopefully hint to the power of the computational complexity classification system in relating hardness of different problems whose complexity is unknown, both offering and limiting sources of examples of various types of hard problems. Shortly after Diffie and Hellman’s paper, Rivest, Shamir and Adleman presented their candidate one-way function, Modular Powering, which is (indirectly) based on the assumed hardness of Integer Factoring. It has important advantages over Modular Exponentiation for cryptographic purposes that we will briefly discuss after defining it. Let p, q be primes, N = pq, and c invertible modulo φ(N) = (p − 1)(q − 1). Define MPN,c : c ZN → ZN by MPN,c(x) = x mod N. This too is a permutation; if d is the inverse of c modulo φ(N) then MPN,d(MPN,c(x)) = x). Again, computing MPN,c is easy. It is believed that inverting it is exponentially hard on random inputs, without access to the factors of N. Appropriately gluing all these functions into one Modular Powering function (indeed, a permutation) MP : I → I, we can have a similar conjecture: Conjecture 4.8. The Modular Powering function MP is a one-way function. The significant advantage of this candidate one-way function is that it has a trap-door43: MP becomes easy to invert if you happen to have access to the factors p, q of N (as with the factors one can efficiently compute the inverse d of c above). This property is the key behind the celebrated RSA public-key cryptosystem44, underlying most digital security systems since its invention! The way it works is extremely simple. I (and you, and Amazon, anyone really) act as follows. I pick at random two large primes p, q and advertise (e.g. on my website) their product N and any c as above. If you want to send me a secret message x, you secretly encrypt x by computing y = MPN,c(x), and then send me y over any public channel (e.g. by e-mail). By Conjecture 4.8, no one can invert y without the factors of N, but I certainly can decrypt your message as I have p, q. This is precisely how your credit card number is protected when you shop online; it is protected as long as a computational complexity assumption about the difficulty of Integer Factoring is true! Let me spell out the absolutely remarkable content of the previous paragraph. The possible existence of trap-door one-way functions (which we will not formally define) does not merely enable on-line shopping and computer security (huge enough as the impact of these has been on society). It allows any two parties, without any prior acquaintance, and in the presence of any others, to set up and use a secret language no one can understand! We note that in an “information theoretic” setting,

42As these classes are deﬁned for decision problems, proving this requires a decision version of ME. For example, given integers a, b, y, decide if there is an x in the interval [a, b] such that ME(x) = y. As inverses exist and are unique, this classiﬁcation problem is both in NP and coNP. Any algorithm for it can invert ME via binary search. 43A notion sometimes signifying private or secret access. 44This notion was already suggested in [DH76], who also explained how it can be indirectly obtained (via a key exchange protocol) from their one-way function ME. Later El Gamal [ElG85] showed how to obtain a public-key cryptosystem directly from ME.

59 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

when computation is free, such a feat is patently impossible. The basic premises of computational complexity: limits on computing power, and the existence of natural hard functions, are absolutely essential! And this was just the beginning. Trap-door functions, born to solve the problem of secret communication, turned out to solve practically every cryptographic problem imaginable. After cryptography was set up on formal foundations in the seminal paper of Goldwasser and Micali [GM84], and statements such as above about secrecy and privacy could be mathematically formulated and proved, the crazy 1980s exploded with papers on other “impossible” tasks becoming possible. On the basis of trap-door functions, Contract Signing, Secret Exchange, Playing Poker over the Telephone, Obliv- ious Computation and more could rest, culminating in the general protocols of [Yao86, GMW87]. Moreover, even the weaker one-way functions were found to be sufficient for, and indeed computationally equivalent to, such notions as private-key cryptosystems, pseudo-random generation (more on that in Section 7.3) and zero-knowledge proofs (more on that in Section 10.2). It is hard to do justice in a page to the new levels of intricacy and subtlety introduced by the needs of cryptography to complexity-theoretic models and notions. We will discuss these modeling issues and results in much greater length in Chapter 18, and keep our comments here rather brief. For one, most problems involve two or more parties, introducing interactive protocols instead of single party algorithms. The importance of adversaries and adversarial thinking was taken far beyond worst-case analysis (where all an adversary can do is choose bad inputs) to the near-arbitrary abuse cryptographic protocols must resist from parties who do not follow them. Reductions between cryptographic protocols and primitives were required to preserve, beyond efficiency, properties like knowledge, and were allowed to manipulate algorithms in new ways, far beyond applying them to given inputs, e.g. to rewind them again and again from arbitrary states. This has enriched computational complexity in a great many ways. One huge impact we will see in Chapter7 is on a fresh understanding of randomness, a concept studied over millennia by many disciplines. Diffie and Hellman wrote their paper soon after the birth of computational complexity and the definitions of P, NP and NP-completeness. In these early days there was optimism that P= 6 NP will soon be proved, and they had every reason to expect that the hardness on average and one-wayness of functions could be proved unconditionally. As we know, this did not pan out, and we have to be content with candidate one-way and trap-door functions, and find other means to support their assumed hardness. For worst-case complexity, the abundance of NP-complete problems of practical importance, and the huge (and independent) efforts invested over decades in trying to efficiently solve them, lends confidence to the assumption that they are hard. For one-way functions, Levin [Lev87] constructed a complete one-way function, namely a function which is one way if one-way functions exist at all. However, it is not quite natural and no one would dream of using it in actual cryptosystems. So, what the world has to rely on to keep enjoying the benefits of cryptography is the assumed hardness of individual problems such as the Discrete Logarithm and Integer Factoring. Of course, since they are used in practically all computer security systems, enormous efforts were made (by good and bad people) to find fast(er) algorithms for them, but so far nothing reasonably efficient was found. Attempts to come up with alternatives have also occupied cryptographers. For one-way functions, we actually have plenty of candidates (indeed almost any computer program probably computes a one-way function, though it is unclear how one would prove that obtaining the input from the output is hard). On the other hand, for trap-door functions we have precious few other examples besides Integer Factoring. A prominent one which is very different from the number theoretic problems above is due to the sequence of works [Ajt96,AD97,PW11], based on the hardness

60 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

of ﬁnding short vectors in random lattices. We will see in Chapter 11 that both Discrete Logarithm and Integer Factoring have fast quantum algorithms, so if quantum computers are ever built, current security systems will become obsolete; no such algorithm is known (yet) for these lattice problems. But for all we know, there may be a fast classical algorithm for factoring (and some number theorists strongly believe this to be the case). Perhaps the most important problem in resting cryptography on solid foundations is to positively answer the following problem.

Open Problem 4.9. Does P= 6 NP, (or even distP= 6 distNP) imply the existence of one-way functions (and even trap-door functions)? Proving hardness (and its diﬃculties) is the subject of our next chapter.

61 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

5 Lower bounds, Boolean Circuits, and attacks on P vs. NP

To prove that P 6= NP we must show that for a given problem, no efficient algorithm exists. A result of this type is called a lower bound (limiting from below the computational complexity of the problem). Several powerful techniques for proving lower bounds have emerged in the past decades. They apply in two (very different) settings. We now describe both, and try to explain our understanding of why they seem to stop short of proving P 6= NP. We only mention very briefly the first, diagonalization, and concentrate on the second, Boolean circuits. We note that Boolean circuits are studied as a computational model in their own right, not only in the context of lower bounds. The connections between this, so-called “non-uniform model” of circuits, to the usual “uniform” model of algorithms, e.g. Turing machines, are not completely understood. The main focus on circuits for lower bound attempts is that each circuit is a finite object, and one can hope (and succeed in limited cases as we shall see) to analyze them using combinatorial methods.

5.1 Diagonalization and relativization The diagonalization technique goes back to Cantor and his argument that the cardinality of the real numbers is larger than the cardinality of the integers. Diagonalization was used by Gödel in his Incompleteness Theorem, and by Turing in his undecidability results (which the reader may wish to recall). It was then refined to prove computational complexity lower bounds on computable functions. A typical theorem in this area is the time-hierarchy theorem of Hartmanis and Stearns [HS65], which essentially says that more time buys more computational power. For example, there are functions computable in time n3, say, which are not computable in time n2. The heart of such arguments (scaling down Turing’s undecidability proof) is the existence of a “universal algorithm”, which can simulate every other algorithm with only small loss in efficiency. Thus an n3- time machine can simultaneously diagonalize against all n2-time algorithms, and compute a function which disagrees with each of them on some input. More sophisticated uses of diagonalization yield other important lower bounds on Turing machines, e.g. [PPST83, For00]. Can such arguments be used to separate P from NP? This depends on what we mean by “such arguments”. The important paper by Baker, Gill, and Solovay [BGS75] proposes a formalization of this proof technique, and shows that with this formalization no such separation can be obtained. This is the first in a sequence of papers which aim to explain the limitations of common proof techniques. Their argument has two parts. First, they note a common feature shared by many diagonalization-like proofs of complexity results, called relativization. A proof relativizes if it remains valid when we modify all algorithms involved (both the simulated and the simulating machines) by giving them free ability to solve instances of any fixed (but arbitrary) problem S ⊆ I. In the common jargon, these machines are all allowed free access to an “oracle” which answers questions about membership in S45. E.g in the example above, an n3-time universal machine with access to S can simulate every n2-time machine with similar access, and so can diagonalize against it equally well as in the original proof. The second part of the [BGS75] paper now shows that relativizing arguments do not suffice to resolve the P vs. NP question. To do so, they define two different oracles, say, S0 and S00 whose presence elicits opposite answers to the P vs. NP question. Namely, with access to S0, the power of “guessing” of NP-machines magically disappears, yielding

45S can be arbitrarily hard, even undecidable.

62 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

“P = NP”, while with access to S00, the power of guessing becomes provably exponentially more powerful, yielding “P 6= NP”. Relativization is further discussed by Fortnow in [For94]. Even today, decades later, most complexity results do relativize. A major way to prove non- relativizing results follows from the arithmetization technique discussed in Section 10.1 on interactive proofs. This was used to prove some lower bounds (e.g. [Vin04, San09]) which do not relativize! To curb the power of this technique, Aaronson and Wigderson [AW09] deﬁned algebrization, a generalization of relativization which incorporates proofs that use arithmetization. They show that proofs which alegbrize are still too weak to resolve the P vs. NP question, as well as other complexity challenges.

5.2 Boolean circuits Boolean circuits are another basic model of computation which we now explore. An excellent text on this subject is by Jukna [Juk12]. A Boolean circuit may be viewed as the “hardware analogue” of an algorithm (software). In- deed, it abstracts the integrated circuits inside a real computer, and many physical control devices. Computation of a circuit on the Boolean inputs proceeds by applying a sequence of Boolean operations (called gates) to compute the output(s). Here we will consider the most common universal set of gates (sometimes called the de Morgan basis), {∧, ∨, ¬}: logical AND (conjunction), OR (disjunction), and NOT (negation), respectively. We assume here that ∧, ∨ are each applied to two arguments. We note that while an algorithm can handle inputs of any length, a circuit can only handle one input length (the number of input “wires” it has). Figure 11 illustrates a computation of the Parity function on 4 bits; computation proceeds from the inputs (at the bottom) to the output (at the top). A circuit is commonly represented as a (directed, acyclic) graph, with the assignments of gates to its internal vertices. We note that a Boolean formula, commonly used in Boolean logic, is simply a Boolean circuit whose graph structure is a tree. Recall that I denotes the set of all binary sequences, and that Ik is the set of sequences of length exactly k. If a circuit has n inputs and m outputs, it is clear that it computes a finite function g : In → Im. The efficiency of a circuit is measured by its size, which is the analogue of time in algorithms. Definition 5.1 (Circuit size). For a finite function g denote by S(g) the size of the smallest Boolean circuit computing g. More generally, for f : I → I with fn the restriction of f to inputs of size n, we define S(f) to be the mapping from n to S(fn). As we care about asymptotic behavior, we will view functions f : I → I as a sequence of finite functions f = {fn}, where fn is a function on n input bits, namely the restriction of f to input of size n. We shall study the complexity S(fn) asymptotically as a function of n, and denote it S(f). E.g. let PAR be the parity function, computing if the number of 1’s in a binary string is even or 46 odd. Then PARn is its restriction to n-bit inputs and it is not hard to check that S(PAR) = O(n). Circuit families can efficiently simulate algorithms. It is quite straightforward to prove that an algorithm (say, a Turing machine) for a function f that runs in time T gives rise to a circuit family 2 for the functions fn of sizes O((T (n)) ). The circuit cn computing fn simulates the given Turing machine on length-n inputs. As this infinite circuit family {cn} arises from a single algorithm, it

46 Namely, PARn(x1, x2, ··· , xn) = x1 ⊕ x2 ⊕ · · · ⊕ xn.

Avi Wigderson Mathematics and Computation Draft: March 27, 2018

+ + +

x y z + w V V

V V

¬! ¬!

V V V V

¬! ¬! ¬! ¬! x y z w

Figure 11: A circuit computing parity on 4 bits. is called a uniform family. Ignoring uniformity, we obtain the circuit analogue of the algorithmic class P. Deﬁnition 5.2 (The class P/poly). Let P/poly denote the set of all functions computable by a family of polynomial-size circuits. Namely, all functions f : I → I such that S(f) grows polynomially with n. The simulation above proves Theorem 5.3. P ⊆ P/poly. As a consequence of this simple simulation, lower bounds for circuits imply lower bounds for algorithms, and so we can try to attack the P vs. NP problem via circuits (completely dropping uniformity). The conjecture guiding this section, much stronger than Conjecture 3.6, is Conjecture 5.4. N P 6⊆ P/poly. Is this a reasonable conjecture? As mentioned above, P ⊆ P/poly. However, the converse of this statement fails badly! There exist undecidable functions f (which cannot be computed by Turing machines at all, regardless of their running time), that have linear-size circuits47. This extraor- dinary power of small circuits to solve undecidable problems comes from dropping the uniformity

47 An example is f = {fn} where fn is a constant function, whose output is 1 or 0 depending on whether n encodes a solvable Diophantine equation or not.

64 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

assumption; the fact that circuits for different input lengths share no common description. Indeed, the circuit model is sometimes called “non-uniform”. If small circuits can compute undecidable functions, this seems to make proving super-polynomial circuit lower bounds a much harder task than proving that P= 6 NP. However, there is a strong sentiment that the extra power provided by non-uniformity is irrelevant for problems in NP. This sentiment is supported by a theorem of Karp and Lipton [KL82], proving that the (non-uniform) assumption N P ⊆ P/poly implies a surprising “collapse” of (uniform) complexity classes capturing quantified problems (defined in Section 4.1). Such a collapse is similar to, but weaker than, the statement NP = coNP.

Theorem 5.5 [KL82] If N P ⊆ P/poly then Π2 = Σ2 (and hence, PH = Σ2). Still, what motivates replacing the Turing machine by the potentially more powerful circuit families when seeking lower bounds? The hope is that focusing on a ﬁnite model will allow for combinatorial techniques to analyze the power and limitations of eﬃcient algorithms. This hope has materialized in the study of restricted classes of circuits (see e.g. Section 5.2.3).

5.2.1 Basic results and questions We have already mentioned several basic facts about Boolean circuits, and in particular the fact that they can efficiently simulate Turing machines. The next basic fact is that most Boolean functions require exponential-size circuits. This is due to the gap between the number of functions and the number of small circuits. Fix n the number of input bits, n. The number of possible functions on n bits is precisely 22 . On the other hand, an upper bound on the number of different circuits of size s (via crudely estimating the 2 number of graphs of that size, and the choices for possible gates in each node) is roughly 2s . Since every circuit computes one function, we must have s > 2n/3 for most functions48. This is known as the counting argument, and is originally due to Shannon [Sha49a]. n/3 Theorem 5.6 [Sha49a] For almost every function f : In → {0, 1}, S(f) ≥ 2 . So hard functions for circuits (and hence for Turing machines) abound. However, as the hardness above is proved via a counting argument, it supplies no way of putting a finger on one hard function. We shall return to the nonconstructive nature of this problem in Section6. So far, we cannot prove such hardness for any explicit function f (e.g., for an NP-complete function like SAT ), even though it is believed to be true. It basically says that no significant time savings are possible over brute-force exhaustive search in solving SAT . Conjecture 5.7. S(SAT ) = 2Ω(n). It is not surprising that we cannot prove this conjecture, as it is much stronger than Conjec- ture 3.649. But our failure in establishing lower bounds is much worse—no nontrivial lower-bound is known for any explicit function. Note that for any function f on n bits (which depends on all its inputs), we trivially must have S(f) ≥ n, just to read the inputs. The main open problem of

48In many cases we will be deliberately give weaker bounds than best possible when it allows simpler calculations and crude estimates. 49There is great value in making strong conjectures! We recommend finding out more about the related Exponential Time Hypothesis (ETH) and its variants in the original papers [IPZ01,IP01], and in some of the recent applications, e.g. in the survey [LMS11]. This conjecture leads to a more refined complexity theory than presented here, which in particular can distinguish different polynomial running times.

65 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

circuit complexity is beating this trivial bound for natural problems (say in NP)—over 60 years of intensive research and we still can’t solve it.

Open Problem 5.8. Find an explicit function f : In → In for which S(f) 6= O(n). A particularly basic special case of this problem is the question of whether addition is easier to perform than multiplication. Let ADD and MULT denote, respectively, the addition and multiplication functions on a pair of integers (represented in binary). For addition, we have an optimal upper bound; that is, S(ADD) = O(n). For multiplication, the standard (elementary school) quadratic-time algorithm was greatly improved by Schönhageand Strassen [SS71] (via Discrete Fourier Transforms) to slightly super-linear, yielding S(MULT ) = O(n log n log log n). The best known algorithm is due to Fürer[Für09], but is still slower than n log n. Now, the question is whether or not there exist linear-size circuits for multiplication. In symbols, is S(MULT ) = O(n)? Unable to prove any nontrivial lower bound, we now turn to restricted models. There has been some remarkable successes in developing techniques for proving strong lower bounds for natural restricted classes of circuits. We discuss in some detail two such models. First formulas, and then monotone circuits.

5.2.2 Boolean formulae Formulas are prevalent throughout mathematics, mostly using arithmetic gates like + and × (arithmetic computation will be discussed in Chapter 12). We focus here on Boolean formulas, as are standard in logic, with the same set of de Morgan connectives {∧, ∨, ¬} (for example, (x ∨ ¬y) ∧ z). A formula may be viewed as a circuit having a tree structure. An example of a Boolean formula computing the Parity function on 4 bits is in Figure 12. We denote the size of a formula by the number of occurrences of variables in it, namely the number of leaves in the tree representing it (which up to a factor of 2 is the same as the number of gates). Let us deﬁne the formula size of (necessarily one-bit output) Boolean functions.

Definition 5.9 (Formula size). For a finite function g : In → {0, 1}, denote by L(g) the size of the smallest Boolean formula computing g. For f : I → {0, 1}, with fn the restriction of f to inputs of size n, we define (as for circuits above) L(f) to be the mapping from n to L(fn). A formula is a universal computational model just like circuits, in that every Boolean function can be computed by a Boolean formula. However, as we shall presently see, formulas are a weaker computational model, so we may hope to prove better lower bounds for it. Indeed, this already happens for essentially the simplest possible function, the parity function P AR discussed above. We mentioned that S(P AR) = O(n) and it is easy to prove (please try) that L(P AR) = O(n2). Two of the earliest results in circuit complexity are lower bounds on parity. They use very different, important lower bound techniques of wide applicability. Let us discuss both in turn. Subbotovskaya [Sub61] proved that L(P AR) = Ω(n1.5), inaugurating the random restriction method. How does this proof technique work to show that any formula for parity must be large (and more generally, that any computation C of a certain class computing a function f must be large)? First observe that fixing some of the input bits to some fixed constants, results in a simpler computation C0 (obtained after “hard-wiring” these values) computing the restricted function f 0 on the remaining variables. The idea now is that if the computational model is “weak”, and the function is “complex”, a clever choice of which variables to fix, and to which values, will render C0 “trivial”

Avi Wigderson Mathematics and Computation Draft: March 27, 2018

+ + +

x y z + w

V V V V V V

V V V V

V V V V V V

V V V V V

¬ ¬ ¬ ¬ ¬ ¬ ¬ ¬ x y x y z w z w z w z w x y x y

Figure 12: A formula computing parity on 4 bits. an f 0 “nontrivial” to yield a patent contradiction50. As it happens, of course C is not given: we have to rule out any small computation, and so such a choice is not easy to make. Subbotovskaya’s idea51 is to simply choose such an input restriction at random!. Here, such restrictions happen to shrink formulae at a much faster rate than the function. Thus, if C is too small, C0 becomes a constant function, while f 0 becomes a parity function on the remaining unﬁxed variables, leading to the lower bound. We will soon return to this idea of shrinkage by random restrictions. A decade later Khrapchenko [Khr72] improved the parity lower bound to a tight L(P AR) = Ω(n2). He used a natural induction on the formula structure to give a general lower bound in terms of the sensitivity of the function computed by it52. An alternative, information theoretic proof of this lower bound was given by Karchmer and Wigderson [KW90]. Their communication complexity method, shows that a formula for a given function may be viewed as a “communication protocol” for a related problem, so lower (and upper) bounds may be proved in this information-theoretic setting! This technique has further applications we will meet again below, and is explained in Section 15.2.3 after we formalize the communication complexity model in Chapter 15. A new idea of Andreev [And87], pushed to its limit (using a tight analysis of the shrinkage of formulas under random restrictions) by H˚astad[H˚as98], gives the best known, nearly cubic gap. In yet another example of the mysterious connections across diﬀerent subareas of computational

50The words “trivial” and “nontrivial” have diﬀerent meanings in diﬀerent applications. 51Which was later rediscovered independently in [FSS84,Ajt83] in the context of constant-depth circuits, and then used throughout complexity theory. See e.g. this survey [Bea94] for applications in circuit and proof complexity 52Sensitivity is a key parameter (actually, a family of parameters) of Boolean functions, useful e.g. when viewed as voting schemes. See more in Section 13.7.

67 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

complexity, Tal [Tal14] gives a diﬀerent proof (with a slightly better bound) that surprisingly involves a quantum argument. More precisely, it uses a general simulation result of arbitrary Boolean formulae by quantum algorithms (we discuss quantum computation in Chapter 11). Theorem 5.10 [H˚as98, Tal14] There is a Boolean function f with S(f) = O(n) and L(f) = Ω(n3−o(1)). The actual gap is believed to be exponential53, and proving a super-polynomial gap is a major challenge of circuit complexity.

Conjecture 5.11. There is a Boolean function f with S(f) = O(n) and L(f) 6= nO(1). One intuitive meaning of this conjecture (which we will not make formal) is asserting the existence of problems which have fast sequential algorithms but no fast parallel ones. We now describe a particular approach to proving this important conjecture, due to Karchmer, Raz and Wigderson [KRW95]. It calls for understanding how formula size behaves under the natural operation of function composition. Definition 5.12. The composition g ◦ f of two Boolean functions f : {0, 1}n → {0, 1} and g : {0, 1}m → {0, 1} has mn input bits, viewed as m vectors xi ∈ {0, 1}n, and is defined by g ◦ f(x1, x2, . . . , xm) = g(f(x1), f(x2), . . . , f(xm)). The most obvious formula computing this composition gives L(g ◦ f) ≤ L(g) · L(f). The KRW- conjecture [KRW95] is that there is no “significantly better” way to do so54. Conjecture 5.13. For every f, g, L(g ◦ f) ≥ α · L(g) · L(f) for some absolute constant α > 0. They further show how this conjecture (and even weaker ones) implies Conjecture 5.11 above, and also lay out a program towards proving it. For the status and history of progress of this program see [GMWW14,DM16]. It is interesting that the cubic lower bound, Theorem 5.10 above, can be viewed as a proof of a very restricted form of Conjecture 5.13. Indeed, [DM16] provide an alternative proof of Theorem 5.10, via the communication complexity method! Lets conclude this subsection with an alternative way to prove Conjecture 5.11 suggested by the communication complexity method. I will state it informally, and again refer the reader to 15.2.3. Consider the following task. I whisper in your ear an n-bit prime number x, and whisper in your friend’s ear an n-bit composite number y. Your goal is to both agree on any number z < 10n, such that x 6= y (mod z). Prove that this goal cannot be achieved by a conversation using O(log n) bits of communication, and you have proved Conjecture 5.11!

5.2.3 Monotone circuits and formulae Many natural functions are monotone in a natural sense. Here is an example, from our list of NP-complete problems. Let CLIQUE be the function that, given a graph on n vertices√ (say by its adjacency matrix), outputs 1 if and√ only if it contains a complete subgraph of size (say) n (namely, all pairs of vertices in some size- n subset are connected by edges). This function is monotone, in the sense that adding edges cannot destroy any clique. More generally, a Boolean function is

53Contrast this with the situation in arithmetic complexity discussed in Chapter 12, where formulas and circuits are much closer in power. 54Indeed, the slack in this inequality can be super-constant, and it is interesting even if this holds for most functions f (or for most g).

68 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

monotone if “increasing” the input (flipping input bits from 0 to 1) cannot “decrease” the function value (cause it to flip from 1 to 0). A natural restriction on circuits comes by removing negation from the set of gates, namely allowing only the gates {∧, ∨}. The resulting circuits are called monotone circuits and it is easy to see that they can compute every monotone function. A counting argument similar to the one we used for general circuits shows that most monotone functions require exponential-size monotone circuits. Still, proving a super-polynomial lower bound on an explicit monotone function was open for over 40 years, until the invention of the so-called approximation method by Razborov [Raz85a]. Theorem 5.14 [Raz85a], [AR87] CLIQUE requires exponential-size monotone circuits. Very roughly speaking, the approximation method replaces each of the {∧, ∨} gates of the (presumed small) monotone circuit with other, judiciously chosen (and complex to describe) approximating gates, {∧˜, ∨}˜ respectively. The choice satisfies two key properties, which together easily rule out small circuits for CLIQUE: 1. Replacing one particular gate by its approximator can only affect the output of the circuit on very few (in some natural but nontrivial counting measure) inputs. Thus, in a small circuit having a few gates, even replacing all gates by their approximators results in a circuit that behaves like the original circuit on most inputs. 2. However, the output of every circuit (regardless of size) made of the approximating gates, produces a function which disagrees with CLIQUE on many inputs55. One natural view of the approximation method is as the description of a progress measure (or potential function) on circuits, to which each gate contributes only a little. If a function is costly in this measure, any circuit for it must be large. We note that while it is natural to view these small aggregate contributions of gates to this measure in a dynamic way, according to their order in the gates in the circuit, there is a static view of this method, exposited by Wigderson in [Wig93]. The CLIQUE function is well known to be NP-complete, and it is natural to wonder if small monotone circuits suffice for monotone functions in P. However, the approximation method was also used by Razborov [Raz85b] to prove an nΩ(log n) size lower bound for monotone circuits computing the Perfect Matching problem (which is monotone and is in P): given a graph, can one pair up the vertices such that every pair is connected by an edge? Theorem 5.15 [Raz85b] Perfect Matching requires super-polynomial size monotone circuits. Interestingly, no exponential lower bound is known for monotone circuits for this problem. Communication complexity techniques (see below) were employed by Raz and Wigderson [RW92] to prove that Perfect Matching requires exponential size monotone formulae. Theorem 5.16 [RW92] Perfect Matching requires exponential size monotone formulae. Tardos [Tar87] finally proved an exponential gap between monotone and non-monotone circuits, for the problem of computing the (monotone, threshold version of the) Lovasz’ Theta function Θ. This problem is in P via semi-definite programming, and the lower bound uses that Theorem 5.14 is much stronger than stated; it holds even if the only input graphs G are either k + 1-cliques (in which case Θ(G) ≥ k + 1) or complete k-partite graphs (in which case Θ(G) ≤ k). The relative power of circuits vs. formulae in the monotone case is also pretty well understood. The first separation was proved by Karchmer and Wigderson [KW90] for graph connectivity, a

55Indeed, such circuits can only compute small, monotone DNFs.

69 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

function which has simple monotone, polynomial size circuits, but they showed requires nΩ(log n) size monotone formulae, a tight bound56. Theorem 5.17 [RW92] Undirected graph connectivity (which has monotone polynomial size circuits) requires super-polynomial size monotone formulae. The monotone formula lower bounds in Theorems 5.16, 5.17 were proved using the communication complexity method mentioned above (and explained in 15.2.3). The communication complexity method was generalized by Raz and McKenzie [RM99], giving much finer separations between monotone circuit and formulae. Their method (called lifting or pattern matrix method in the literature) was greatly enhanced and better understood in a series of recent works, which allows applying it to other monotone models and obtain stronger results more simply - see the paper [CPRR16] and the historical discussion. We conclude this subsection with something short monotone formulae can do: compute the majority function MAJ. Even the task of constructing a non-monotone polynomial size formula for MAJ is not entirely trivial - please try it. However, whether MAJ has polynomial size monotone formulae has been open for decades, until resolved in the early 1980s in two completely different ways, one by Ajtai, Komlósand Szemerédi[AKS83] and one by Valiant [Val84a]. Theorem 5.18 [AKS83, Val84a] Majority has polynomial size monotone formulae. The proof of Ajtai, Komlósand Szemerédiis entirely constructive57, but extremely complex, and leads to a polynomial of exponent in the hundreds58! In contrast, Valiant’s proof is extremely simple and elegant, leads to a small polynomial bound, but is only an existence proof. In what is one of the most stunning examples of the power of the probabilistic method (see [AS00]) he shows while constructing small monotone majority formula seems difficult, almost all of them do compute majority! The best known upper bound on the size is O(n5.3). The best known lower bound (even on non-monotone formulae) is Ω(n2). We have no tools as yet to answer e.g. the following. Open Problem 5.19. Is there a monotone formula for Majority of size O(n3)?

5.2.4 Natural Proofs, or, Why is it hard to prove circuit lower bounds? The 1980s saw a ﬂurry of new techniques for proving circuit lower bounds on natural, restricted classes of circuits. Besides the Approximation Method, these include the Random Restriction method of Furst, Saxe, Sipser [FSS84], and Ajtai [Ajt83] (used to prove lower bounds on constant depth circuits, which we did not discuss), the Communication Complexity method of Karchmer and Wigder- son [KW90] (used above for monotone formula lower bounds above), and others. But they, and all subsequent attempts and results fall very short of obtaining any nontrivial lower bounds for general circuits, and in particular proving that P= 6 NP. Is there a fundamental reason for this failure? The same may be asked about any longstanding mathematical problem (e.g. the Riemann Hypothesis). A natural (vague!) answer would be that, probably, the current arsenal of tools and ideas (which may well have been successful at attacking related, easier problems) does not suﬃce59.

56A completely diﬀerent way of proving a (weaker) super-polynomial separation follows the KRW- conjecture [KRW95] above, which in the monotone case becomes a theorem! 57Making essential use of expander graphs, which we will meet in Section 8.7. 58It solves a much more general problem, constructing a linear size, logarithmic depth sorting network, of which this result is a corollary. 59Such was the case e.g. with Fermat’s last “theorem” for centuries, during which tools developed to eventually allow Wiles and Taylor to prove it (and much more).

70 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Remarkably, complexity theory can make this vague statement into a theorem! Thus we have a “formal excuse” for our failure so far: we can classify a general set of ideas and tools, which are responsible for virtually all restricted circuit lower bounds known, yet must necessarily fail for proving general ones. This introspective result, developed by Razborov and Rudich [RR97], suggests a framework called Natural Proofs. Very briefly, a lower bound proof is natural, if it applies to a large, easily recognizable set of functions. They first show that this framework encapsulates essentially all known circuit lower bounds. Then they show that natural proofs of general circuit lower bounds are unlikely, in the following sense. Any natural proof of a general circuit lower bound surprisingly implies, as a side-effect, a subexponential algorithm for inverting every candidate one-way function. Specifically, a natural (in this formal sense) lower bound would imply subexponential algorithms for such functions as Integer Factoring and Discrete Logarithm, generally believed to be exponentially difficult (to the extent that the security of electronic commerce worldwide relies on such assumptions). This connection strongly uses pseudo-randomness, which will be discussed later (at the end of Chapter 8.4). A simple concrete corollary (see [RR97] for a more general statement) is 1/100 that there is no natural proof that integer factoring requires circuits of size at least 2n (the best 1/3 current upper bound is 2n ). One interpretation of the work on the natural proofs framework is as an “independence result” of general circuit lower bounds from a certain natural fragment of Peano arithmetic. This is formally pursued by Razborov in [Raz95a] (and is related to the difficulty of proving propositional formulations of circuit lower bounds, discussed towards the end of Chapter6 on proof complexity). How far up does this independence go? Note that it is possible that the P vs. NP problem is independent from Peano Arithmetic, or even ZFC Set Theory (as is, e.g. the Continuum Hypothesis). While such independence of P vs. NP is a mathematical possibility, few believe it today. This issue is discussed at length in [Aar03]. The lower bounds of Santhanam [San09] and Vindochandran [Vin04] mentioned in Section 5.1 are circuit lower bounds which bypass the natural proof barrier (as well as relativization). However, as we mentioned there, they both algebrize, see Aaronson and Wigderson [AW09]. The only circuit lower bound technique which avoids all known barriers is due to Williams [Wil14]. It uses a brilliant combination of diagonalization and simulation on the one hand, and circuit-complexity techniques on the other. Unfortunately, it has so far delivered relatively weak new lower bounds. We also mention that for super-polynomial formula lower bounds, Conjecture 5.13 on composition above seems to avoid all known barriers as well, and may thus be used to prove such lower bounds with currently available techniques.

71 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

6 Proof complexity

The reader will have seen, depending on experience, a variety of mathematical theorems and their proofs in various mathematical areas. It is quite likely however that the focus this section takes on proofs, as well as the types of theorems considered here, are quite different than what you are used to. This fresh view of proofs is incredibly rich, and brings out a beautiful set of mathematical problems and results. For extensive surveys on this material see [BP98, Seg07, RW00], and in a bigger context, the book by Krajicek [Kra95]. The concept of proof is what distinguishes the study of mathematics from all other fields of human inquiry. Proofs establish mathematical theorems, whose validity is independent of physical reality. While proofs are typically presented informally in mathematical papers and books, the confidence we have in their outcomes, the theorems, follows the knowledge (or belief) that they can be made completely rigorous, namely formalized to a purely syntactic form whose absolute correctness can be easily verified. This verification algorithm is specified by a proof system, which determines for any two sequences of symbols x, y whether y is a proof of x. In most mathematical proof systems y is a sequence of sound deductions deriving x from a set of “self-evident” axioms. Such a formalism makes proofs themselves the object of mathematical investigation, mainly in proof theory and logic. Needless to say, the practice of mathematics is not a syntactic game. While rigor is paramount, mathematicians care about the meaning of what they prove and how they prove it! So theorems x would not be just abstract symbols, but rather typically describe meaningful properties of certain natural mathematical structures. Similarly, proof systems encompass various types of reasoning, and proofs y will typically combine ideas, techniques and past theorems to “reason out” a new theorem. With centuries of experience, mathematicians often attribute (and argue about) such adjectives to proofs as “beautiful, insightful, original, deep” and, most notably, “difficult”, which this section on proof complexity focuses on. Is it possible to quantify, mathematically, the difficulty of proving various theorems? This is exactly the task undertaken in the field of proof complexity. It focuses on propositional proof systems (that we will soon define and discuss), that are the simplest from a purely logical standpoint; these systems are designed to prove statements about finite structures. Proof complexity seeks to classify propositional theorems (called tautologies) according to the difficulty of proving them, much like circuit complexity seeks to classify functions according to the difficulty of computing them. Indeed, proof complexity bears a similar relation to proof theory as that of circuit complexity to computability theory. In proofs, just as in computation, there will be a number of models, called proof systems, capturing the power (or structure) of reasoning allowed to the verifier. Proof systems exist in abundance in all areas of mathematics (and not just in logic), sometimes implicitly. Indeed, the statement that a given mathematical structure possesses some property is a canonical example of what mathematicians are trying to establish. And the mathematical framework for establishing those statements which are true—the theorems in such settings—can typically (and naturally) be viewed as a proof system. Let us see some examples of proof systems outside of the familiar logical ones (to which we will return later), and discuss the notion of proof length in each. These in particular reveal proof length as natural, and we will discuss this point further afterwards. Some may not be familiar to you—feel free to skip or find out more yourself. 1. Hilbert’s Nullstellensatz may be viewed as supplying a (sound and complete) proof system in which theorems are inconsistent systems of polynomial equations60.A proof expresses the 60Such a system may be viewed as a statement: “no valuation to the variables simultaneously satisfies all equations

72 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

constant 1 as a linear combination (with polynomial coeﬃcients) of the given polynomials. 2. Each ﬁnitely presented group61 can be viewed as a proof system, in which theorems are words that reduce to the identity element. A proof is the sequence of substituting relations which transforms the word to the identity. Such proofs have a nice geometric representation, called Dehn diagrams (or van Kampen diagrams), in which proof length is captured by the “area”— the number of regions in the diagram. 3. Reidemeister moves are a proof system in which theorems are plane diagrams of trivial (unknotted) knots. A proof is the sequence of moves reducing the given plane diagram of the knot into one with no crossings. Think of a circular string lying scrambled on the table, and the moves unscrambling it make local changes around one crossing at a time.

4. von Neumann’s Minimax theorem gives a proof system for every zero-sum game. A theorem is an optimal strategy for White, and its proof is a strategy for Black which guarantees the same payoﬀ62.

In each of these and many other examples, the length of the proof plays a key role, and the quality (or expressiveness) of the proof system is often related to how short the proofs it provides can be. 1. In the Nullstellensatz (over fields of characteristic 0), length (of the “coefficient” polynomials, typically measured by their degree and height) plays an important role in the efficiency of commutative algebra software, e.g. Gröbnerbasis algorithms. 2. The word problem in general is undecidable. For hyperbolic groups, Gromov’s polynomial upper bound on proof length has many uses. One is his own construction of finitely presented groups with no uniform embeddings into Hilbert space [Gro03].

3. In a very recent advance, a polynomial upper bound on the length of Reidemeister proofs for unknottedness was given in [Lac15]. 4. In zero-sum games, happily all proofs are of linear size. We stress that the asymptotic view point, namely considering families of theorems as above and measuring their proof length as a function of the description length of the theorems proved, is natural and prevalent in mathematics. As was the case for computation, here too this asymptotic viewpoint reveals structure of the underlying mathematical objects, and economy (or efficiency) of proof length often correlates with better understanding them. While this viewpoint is relevant to a large chunk of mathematical work, it seems to fall short of explaining the difficulty of most challenges mathematicians face, namely the difficulty of proving single statements (in which asymptotics are not present), such as the Riemann Hypothesis or P= 6 NP. Let us probe this point a bit deeper. As it turns out, often such “single” mathematical statements can be viewed and studied asymptotically (of course, this may or may not illuminate them better). For example, the Riemann Hypothesis has an equivalent formulation as a sequence of finite statements, e.g. about cancellations in the Möbiusfunction, up to every finite bound n, which we in the system”. 61Namely, given by a finite set of generators and relations. 62Naturally, the reverse holds as well, and there is a duality between theorems and proofs in this system.

73 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

shall see later in Section 8.3 on pseudo-randomness. Perhaps more interestingly, in the following Section 8.4 we will discuss a formulation of the P/poly vs. NP problem as a sequence of finite statements, whose proof complexity turns out to be strongly related to the Natural Proofs paradigm mentioned in Section 5.2.4 on the difficulty of proving circuit lower bounds. These are just examples of a general phenomenon: statements in first-order logical systems, like Peano Arithmetic (or fragments thereof) can be turned into a sequence of finite propositional statements, such that proof length lower bounds for them (in the appropriate propositional system) can imply unprovability in the first-order setting. In other words, the propositional setting we discuss here can provide standard unprovability and independence results! This idea originated by Paris and Wilkie [PW85] for a particular fragment, and was explained more generally by Krajicek in the book [Kra95]. All theorems which will concern us in this chapter are universal statements (e.g. an inconsistent set of polynomial equations is the statement that every assignment of values to the variables fails to satisfy them all). A short proof for a universal statement constitutes an equivalent formulation of that statement which is existential—the existence of the proof itself certifying the universal property (e.g. the existence of the “coefficient” polynomials in Hilbert’s Nullstellensatz which implies the inconsistency of the given polynomial equations). The mathematical motivation for this focus is clear—the ability to describe a property both universally and existentially constitutes necessary and sufficient conditions—a cornerstone of mathematical understanding, discussed in section 3.5. Here we shall be picky and quantify that understanding according to a (computational) yardstick: the length of the existential certificate. We shall restrict ourselves to propositional tautologies, namely ranging over Boolean variables (we will shortly give an example). These can naturally encompass all true statements about discrete structures, and turn out to provide a remarkably broad and deep arena of study. This focus actually guarantees an exponential (thus a known, finite) upper bound on the proof length of any theorem considered, freeing us from any Gödelianworries of unprovability. It restricts the range of potential proof lengths (as with time in the case of P vs. NP) to be between polynomial and exponential. In an analogous way to the computation time, exponential proof length here will correspond to trivial, “brute force” proofs, and the possibility (or impossibility) of finding clever short proofs. The type of statements, theorems and proofs we shall deal with is best illustrated by the following example.

6.1 The pigeonhole principle—a motivating example Consider the well-known “pigeonhole principle”, stating that there is no injective mapping from a finite set to a smaller one. While trivial, we note that this principle was essential for the counting argument proving the existence of exponentially hard functions (Theorem 5.6)—this partially explains our interest in its proof complexity. More generally, this principle epitomizes non-constructive arguments in mathematics, such as Minkowski’s theorem that a centrally symmetric convex body of sufficient volume must contain a lattice point, or Erd˝os’probabilistic proof that a small Ramsey graph63 exists. In these and many other examples, the proof does not provide any information about the object proved to exist. The same happens for proofs of other combinatorial tautologies which capture the essence of topological theorems (e.g. Brouwer’s fixed point theorem, the Borsuk-Ulam Theorem, and Nash’s equilibrium)—see Papadimitriou [Pap94] for more. Let us formulate the pigeonhole principle and discuss the complexity of proving it. First, we m turn it into a sequence of finite statements. Fix m > n. Let PHP n stand for the statement there 63A graph without large cliques and independent sets.

74 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

is no 1–1 mapping of m pigeons to n holes. To formulate this mathematically, imagine an m × n matrix of Boolean variables xij describing a hypothetical mapping (with the interpretation that 64 xij = 1 means that the ith pigeon is mapped to the jth hole ). m Deﬁnition 6.1. [The pigeonhole principle] The pigeonhole principle PHP n now states that

• either some pigeon i ∈ [m] is not mapped anywhere (namely, all xij for a ﬁxed i are zeros), • or some two pigeons are mapped to the same hole (namely, for some diﬀerent i, i0 ∈ [m] and some j ∈ n we have xij = xi0j = 1).

These conditions are easily expressible as a formula using Boolean gates in the variables xij (called a propositional formula). Let us write it explicitly.      _ ^ _ _   ¬xij ∨  (xij ∧ xi0j) i∈[m] j∈[n] i6=i0∈[m] j∈[n]

The pigeonhole principle is the statement that this formula is a tautology (namely satisfied by every truth assignment to the variables). Even more conveniently, the negation of this tautology (which is a contradiction, namely a formula satisfied by no assignment), can be captured by a collection of constraints on these Boolean variables which are mutually contradictory. Such collections of constraints can be expressed in different languages:

• Algebraic: as a set of bounded degree polynomials over F2 (or other fields). • Geometric: as a set of linear inequalities with integer coefficients (to which we seek a {0, 1} solution). • Logical: as a set of Boolean disjunctions. We shall see in Section 6.3 below, that each setting naturally suggests (several) reasoning tools, such as variants of the Nullstellensatz in the algebraic setting, of Frege systems in the logical setting, and Integer Programming heuristics in the geometric setting. All of these can be formalized as proof systems that can prove this (and any other) tautology. Our main concern will be in the efficiency of each of these proof systems, and their relative power, measured in proof length. Before turning to some of these specific systems, we discuss this concept in full generality.

6.2 Propositional proof systems and NP vs. coNP Most deﬁnitions and results in this subsection come from the paper which initiated this research direction, by Cook and Reckhow [CR79]. We deﬁne proof systems and the complexity measure of proof length for each, and then relate these to complexity questions we have met already. All theorems we shall consider will be propositional tautologies. Here are the salient features that we expect65 from any proof system.

64Note that we do not rule out the possibility that some pigeon is mapped to more than one hole—this condition can be added, but the truth of the principle remains valid without it. 65Actually, even the first two requirements are too much to expect from strong proof systems, as Gödelfamously proved in his Incompleteness Theorem. However, for propositional statements which have finite proofs there are such systems.

75 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• Completeness. Every true statement has a proof. • Soundness. No false statement has a proof. • Verification efficiency. Given a mathematical statement T and a purported proof π for it, it can be easily checked (in P) if indeed π proves T in the system. Note that here efficiency of the verification procedure refers to its running-time measured in terms of the total length of the alleged theorem and proof. Remark 6.2. Note that we dropped the requirement used in the definition of NP, limiting the proof to be short (polynomial in the length of the claim). The reason is, of course, that proof length is now our measure of complexity.

All these conditions are concisely captured, for propositional statements, by the following deﬁ- nition. Deﬁnition 6.3 (Proof systems, [CR79]). A(propositional) proof system is a polynomial-time algorithm M with the property that T is a tautology if and only if there exists a (“proof ”) π such that M(π, T ) = 1.

As a simple example, consider the following “Truth-Table” proof system MTT. Basically, this machine will declare a formula T a theorem if evaluating it on every possible input makes T true. A bit more formally, for any formula T on n variables, the machine MTT accepts (π, T ) if π is a list of all binary strings of length n, and for each such string σ, T (σ) = 1. Note that MTT is indeed a proof system; it is sound, complete, and runs in polynomial time in its input length, which the combined length of formula and proof. But in the system MTT proofs are of exponential length in the size in the number of variables, and so typically also exponential in the size of the given formula. This length is what we will care about. It leads us to the deﬁnition of the eﬃciency (or complexity) of a general propositional proof system M—how short the shortest proof of each tautology is.

Definition 6.4 (Proof length, [CR79]). For each tautology T , let SM (T ) denote the size of the shortest proof of T in M (i.e., the length of the shortest string π such that M accepts (π, T )). Let SM (n) denote the maximum of SM (T ) over all tautologies T of length n. Finally, we call the proof O(1) system M polynomially bounded iff for all n we have SM (n) = n . Is there a polynomially bounded proof system (namely one which has polynomial size proofs for all tautologies)? The following theorem provides a basic connection of this question with computational complexity, and the major question of Section 3.5. Its proof follows quite straightforwardly from the NP-completeness of SAT, the problem of satisfying propositional formulae, the fact that a formula is unsatisfiable iff its negation is a tautology, and the observation that a short proof in any propositional proof system certifies (in the sense of NP) such unsatisfiability. Theorem 6.5 [CR79] There exists a polynomially bounded proof system if and only if NP = coNP. In the next section we focus on natural restricted proof systems. We note that a notion of reduction between proof systems, called polynomial simulation, was introduced by Cook and Reckhow in [CR79] and allows us to create a partial order on the relative power of some systems. This is but one example of the usefulness of the computational complexity methodology developed within complexity theory after the success of NP-completeness.

76 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

6.3 Concrete proof systems Almost all proof systems in this section are of the familiar variety, going back to the deductive system introduced in The Elements of Euclid for plane geometry. Each proof start with a list of formulae (assumed “true”), and by a successive use of simple (and sound!) derivation rules infer new formulae (each formula is called a line in the proof). Typically the starting formulae will be axioms, and the ﬁnal derived formula will be the proven theorem. Here, and in this research area in general, it is often more convenient to focus on the related notion of contradiction systems, which prove a theorem by refuting its negation. More precisely, one starts with a contradictory set of formulae, and derives a basic, patently evident contradiction (e.g. ¬x ∧ x, 1 = 0, 1 < 0), depending on the setting. We highlight some results and open problems on the proof length of basic tautologies in algebraic, geometric, and logical systems. In each of these sections, we will give an example of a proof system in action, refuting the small contradiction φ in Figure 13, which has the 5 (mutually contradictory) “axioms” in 4 variables.

A1 ¬x ∨ w A2 ¬w ∨ y A3 ¬y A4 x ∨ y ∨ z

A5 ¬z ∨ x Figure 13: The contradiction φ

6.3.1 Algebraic proof systems Here, a natural representation of a Boolean contradiction is a set of multivariate polynomials with no common root. Fix a field F (many but not all results hold for any field). To ensure that we consider only roots with Boolean 0, 1 values, we always add to such a collection the polynomials x2 −x (for every variable x). These added “axioms” ensure that all possible roots are in F itself (no need for the algebraic closure). This also effectively makes all polynomials in the proof multilinear, and greatly simplifies some of the issues arising in general—for example, degrees of polynomials will never exceed the number of variables. Note that it is always easy to encode a Boolean formula as a polynomial. Here is one way m to represent the constraints of the pigeonhole principle PHP n , defined above (6.1), as a set of P contradictory (constant degree) polynomials. For every pigeon i, add the polynomial j xij − 1, 0 and for every two pigeons i, i and every hole j, add the polynomial xijxi0j. Now, let us discuss two concrete algebraic proof systems. The paper [BKI+96] suggests a proof system, based on Hilbert’s Nullstellensatz, which states that if the polynomials f1, f2, . . . , fm over n variables have no common root, then the constant function 1 is in the ideal generated by these polynomials. In other words, there must exist polynomials g1, g2, . . . , gm such that X figi ≡ 1. i

77 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

0 Note that the coefficients gi indeed constitute a proof: if the fi s had a common root, such an identity could not hold. This ensures soundness. Completeness is given in Hilbert’s famous Nullstellensatz, which in this Boolean setting is much easier to prove. A natural measure of proof length is the description length of the polynomials as lists of all their coefficients (this is called a dense representation). Another important complexity parameter of Nullstellensatz proofs is degree: a proof has degree d if for all i the polynomial figi has degree at most d. Note that if d is the minimal degree of any proof, then the length of any proof in this n d dense representation is at least d and at most m(2n) . Thus the degree d practically determines the proof-length in this representation, and we shall thus focus on degree. Finally note that proof verification in this system is easy; a simple polynomial-time algorithm can efficiently test if given P gi’s satisfy i figi ≡ 1. A related proof system, intuitively based on computations of Gröbnerbases, is Polynomial Cal- culus, abbreviated PC, which was introduced by Clegg, Edmonds and Impagliazzo in [CEI96]. The lines in this system are polynomials (again represented explicitly by all coefficients), and it has two deduction rules, capturing the definition of an ideal: addition of two ideal elements, and multiplication of an ideal element by any polynomial. Specifically, for any two polynomials g, h and variable xi, we can • Addition: use g and h to derive g + h.

• Extension: use g to derive gxi (or, more generally, derive gh). Observe the soundness of the rules: if the input polynomials to the rule evaluate to 0 on a given variable assignment, so does the output polynomial. The task, as in Nullstellensatz, is to derive the constant 1 from the axioms. One may view such a proof as constructing the contradictory identity as in Nullstellensatz but in “small steps”, which may yield smaller degree and description lengths of the polynomials appearing in the proof. Figure 14 below describes a refutation, expanded as a tree, of the contradiction φ of Figure 13 in the system PC. Note that the axioms A1–A5 are encoded as polynomials, and both deduction rules are used. It is possible to show that for both proof systems above, if there is a proof of size s for some tautology, then this proof can be found in time polynomial in s. Indeed, as we are measuring size in the dense representation of polynomials, finding the proof in the Nullstellensatz system reduces to solving a linear system of size poly(s), whose variables are the coefficients of all polynomials appearing in the proof. For polynomial calculus the proof finding algorithm given by [CEI96] is a simple variant of the Gröbnerbasis algorithm, which in our propositional setting requires polynomial time as in the proof size as well. A proof system with this property, namely that short proofs, if they exist, may be efficiently found, is called automatizable, as one can efficiently automate proof-search. Recalling our discussion on P vs. NP vs. coNP above, we do not expect that really strong propositional proof systems are automatizable. The two systems above already illustrate that some types of reasoning can be more efficient than others. The PC system is known to be exponentially stronger than Nullstellensatz. More precisely, [CEI96] proves that there are tautologies which require exponential-length Nullstellensatz proofs, but only polynomial length PC proofs. However, strong size lower bounds (obtained from degree lower bounds as explained above) are known for the PC system as well. Indeed, the pigeonhole principle is hard for this system. For its natural encoding of PHP as a contradictory set of quadratic polynomials as above, Razborov [Raz98b] proved

78 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

x (1-x)

x (1-y) x y (1-x) y (1-x) (1-y)

(1-y) x (1-w) x (1-y) w (1-x) (1-y) (1-z) (1-y) (1-x) z A4

x (1-w) (1-y) w y y (1-x) z A1 A2 A3 A3 A5

Figure 14: A tree-like Polynomial Calculus refutation of φ

m n/2 Theorem 6.6 [Raz98b] For every n and every m > n, SPC(PHP n ) ≥ 2 , over every ﬁeld.

6.3.2 Geometric proof systems

Cutting Planes proofs Yet another natural way to represent Boolean contradictions is by a set of regions in space containing no integer points. A wide source of interesting contradictions are Integer Programs from combinatorial optimization. Here, the constraints are (affine) linear inequalities with integer coefficients (so the regions are subsets of the Boolean cube carved out by halfspaces). A proof system infers new inequalities from old ones in a way which does not eliminate integer points. The most basic system is called Cutting Planes (CP), introduced by Chvátal[Chv73]. Its lines are linear inequalities with integer coefficients. Its deduction rules are addition and integer division. Specifically, assume ì, mi, a, b, c are integers. P P P • Addition: use ìxi ≥ a and mixi ≥ b to infer (ì + mi)xi ≥ a + b. P P • Integer division: If c divides all mi, use mixi ≥ b to infer (mi/c)xi ≥ db/ce. A refutation derives a basic contradiction, e.g. 0 ≥ 1 from the axioms. Figure 15 below describes a refutation, expanded as a tree, of the contradiction φ of Figure 13, in the system CP. Note that the axioms A1–A5 are encoded as linear inequalities, and both deduction rules are used.

79 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

0 ≥ 1

-x ≥ 0 x ≥ 1

y – x ≥ 0 -y ≥ 0 2x ≥ 1

w – x ≥ 0 y –w ≥ 0 -y ≥ 0 2x + y ≥ 1

w +(1-x) ≥ 1 (1-w) + y ≥ 1 (1-y) ≥ 1 x + y + z ≥ 1 x – z ≥ 0 A1 A2 A3 A4

(1-y) ≥ 1 x +(1-z) ≥ 1 A3 A5

Figure 15: A tree-like Cutting Planes refutation of φ

It is not hard to see that, if the original Boolean axioms are disjunctions (as in the contradiction φ), then when we translate them to linear inequalities as above, whenever they have a satisfying integer assignment, they also have a Boolean one. In other words, cutting planes is a sound and complete propositional proof system. m Let us consider again the pigeonhole principle PHP n . First, let us express it as a set of contradictory linear inequalities: For every pigeon, the sum of its variables should be at least 1. For every hole, the sum of its variables should be at most 1. Thus, adding up all variables in these two ways implies m ≤ n, a contradiction. Therefore, the pigeonhole principle has polynomial-size CP proofs. m While PHP n is easy in this system, exponential lower bounds were proved for other tautologies, k and we explain how next. Consider the tautology CLIQUE n: No graph on n nodes can simultaneously have a k-clique and a legal k − 1-coloring. It is easy to formulate this tautology as a propositional formula. Notice that it somehow encodes many instances of the pigeonhole principle, one for every k-subset of the vertices. √ n n1/10 Theorem 6.7 [Pud97] SCP CLIQUE n ≥ 2 . The proof of this theorem by Pudlak [Pud97] is quite remarkable. It reduces this proof complexity lower bound into a circuit complexity lower bound. In other words, Pudlak shows that any short CP- proof of tautologies of certain structure yields a small circuit computing a related Boolean function (this is a general method which is discussed below in Section 6.4). You probably guessed that for the tautology at hand, the hard function to be used is indeed the CLIQUE function introduced earlier. Thus, if the resulting circuit was a monotone Boolean circuit (as in Section 5.2.3), we would

80 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

be done by 5.14. As it turns out, the circuits Pudlak obtains are monotone, but are stronger as they are allowed to use real rather than Boolean values. More precisely, rather than having only ∧, ∨ as basic gates, these circuits can use any monotone binary operation on real numbers as a gate: their inputs and output must be Boolean, but intermediate values can be arbitrary Reals. Such circuits are indeed far stronger—they can solve some NP-complete problems in linear size [Ros97]! Despite that, Pudlak proceeds to generalize Razborov’s approximation method (Section 5.2.3) for such circuits, and proves that even they require an exponential size to compute CLIQUE. A diﬀerent proof, obtained independently by Cook and Haken, appears in [HC99]. An earlier, lower bound on “tree-like” CP-proof size, via a diﬀerent method, is described in Section 15.2.4.

Sum-of-Squares proofs A much stronger geometric proof system (for polynomials over the Reals) has recently emerged as important for optimization, machine learning and complexity, called the Sum-of-Squares (SOS) system66. It was introduced in several papers [Sho88,Nes00,Par00,Las01,GV01], with motivations from optimization, statistics (moment problems) and proof complexity. Curiously, the origins of SOS can be traced back to Hilbert’s 17th problem, which inspires this proof system in the same way his Nullstellensatz theorem inspired proof systems in the previous section. Recall that Hilbert’s 17th problem concerns multivariate polynomials over the Real numbers. It starts with the observation that every sum of squares of polynomials is everywhere non-negative, and asks if the converse is true, namely if every polynomial which is non-negative everywhere can be written as a sum of squares (of rational functions). Hilbert’s 17th was solved affirmatively by Artin [Art27]. Further development of these ideas lead to the Positivstellensatz theorem of Krivine [Kri64], Stengel [Ste74], Putinar [Put93] and others, a cornerstone of Real algebraic geometry, which gives a characterization of when a set of polynomial equations and inequalities has no common solution. The SOS system (which we explain for simplicity only for refuting systems of only equations), utilizes this characterization. It proves that a set of Real polynomials f1, f2, . . . , fn (with any number of variables) have no common root, by exhibiting polynomials g1, g2, . . . , gn and h1, h2, . . . hk such that X X 2 figi ≡ 1 + hj i j 2 Such a proof is said to have degree d if the degrees of all figi and hj do not exceed d. Clearly, the SOS system is at least as strong as the Nullstellensatz system in the previous section, in which squares cannot be used. Moreover, Grigoriev gives examples showing that the SOS system can be exponentially stronger, i.e. tautologies67 for which Nullstellensatz or PC refutations require linear degree, but SOS proves them with constant degree (and thus in polynomial size) [Gri01a]. It turns out that SOS is also more powerful than the cutting-planes system CP above, as well as several important linear and semi-definite based proof systems like [SA90, LS91]. Another property SOS shares with Nulstellensatz and Polynomial Calculus PC, is being automa- tizable68. Namely, if a system of polynomial equations (and inequalities) has a degree-d SOS-proof, then this proof (which has size at most nd, the number of coefficients needed) can actually be found in time nO(d) (using semi-definite programming). For constant d such proofs (if they exist) can be found in polynomial time! This property is important for obtaining efficient approximation

66It is also referred to in the literature as Positivestellensatz or Lasserre. 67 1 E.g. that x1 + x2 + ··· + xn = 2 has no 0/1-solution. 68Although, one should consider the caveats and precise statement in [O’D16].

81 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

algorithms for the large variety of (non-convex) problems that can be formulated as follows: find the maximum value that a given multivariate polynomial attains in a semi-algebraic subset of Rn, one defined by polynomial equations and inequalities (say all of constant degree). SOS provides a hierarchy of approximation algorithms for this optimal value, that are parametrized by the degree d of polynomials used in proving this approximation; as d increases the quality of the approximation typically improves, while the running time increases. Numerous applications of this algorithm are known (see e.g. Lasserre [Las09]). Recent applications and connections to complexity theory, machine learning, quantum information and more are surveyed by Barak and Steurer [BS14]. Crucial to many of these applications is the fact that many basic inequalities (Cauchy-Schwarz, Hölder, hypercontractive inequalities for polynomials, triangle inequalities for various norms etc.) have constant-degree SOS-proofs69. Which tautologies are hard for this SOS system? As usual, we are mainly interested here in discrete problems, i.e. polynomial equations over Boolean variables as in the previous section. Their 2 encoding as Real polynomials is easily achieved in the same way, by adding the polynomials xi − xi as axioms. In this setting, (as polynomials are multilinear without loss of generality), it is not hard to see that proofs never require degree larger than n. One of the strongest results we have is a linear degree lower bound for “almost all” inconsistent systems of linear equations over F2. Theorem 6.8 [Gri01b,Sch08] For every n let f1, f2, . . . , f10n be randomly and independently chosen linear equations over n variables of the form xi + xj + xk = b (where i, j, k are uniformly random in [n] and b is random in {0, 1}). Then with probability 1−o(1) the encoded system of Real polynomials has no common root, and every SOS refutation requires degree Ω(n). The relation between degree and size of SOS proofs (namely, that degree d proofs can be found in time nO(d) via semi-definite programming, and hence have size at most nO(d)), is shown to be tight for e.g. 4−SAT in [LN15]. A tight relation between size of semi-definite programs and degree of SOS proofs, implying exponential SDP lower bounds, is established in the breakthrough by Lee, Raghavendra and Steurer [LRS14].

6.3.3 Logical proof systems The proof systems in this section will all have lines that are Boolean formulae, and the differences between these systems will be in the structural limits imposed on these formulae. We introduce the most important ones: Frege, capturing “polynomial time reasoning,” and Resolution, the most useful system used in automated theorem provers. The most basic proof system, called the Frege system, puts no restriction on the formulae manipulated by the proof. As a refutation system, it has one nontrivial derivation rule, called the cut rule (or Modus Ponens): • Cut rule: Use formulas A ∨ C,B ∨ ¬C to infer the formula A ∨ B Other derivation rules allow e.g. to take the conjunction of two previously derived formulas, as well as the disjunction of a previously derived formula with an arbitrary one. As usual, a refutation should derive a contradiction, e.g. the empty clause, or x ∧ ¬x, from the given axioms. The size of a Frege proof is simply the total size of all formulas appearing in it. Every basic book in logic has a slightly different way of describing the Frege system. One convenient outcome of the computational approach, especially the notion of efficient reductions

69E.g. here is a degree-4 proof of the Cauchy-Schwarz inequality: Pn 2 Pn 2 Pn 2 1 P 2 ( i xi )( i yi ) − ( i xiyi) = 2 ( i6=j (xiyj − xj yi) ) ≥ 0

82 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

between proof systems, is a proof (by Cook and Reckhow [CR79]) that they are all equivalent, in the sense that the shortest proofs (up to polynomial factors) are independent of which variant you pick! The Frege system can polynomially simulate both the Polynomial Calculus70 and the Cutting Planes systems. In particular, the “counting” cutting-planes proof described above for the pigeonhole principle can be carried out eﬃciently in the Frege system (not quite trivially!), yielding n+1 O(1) Theorem 6.9 [Bus87]( PHP n ) has Frege proofs of size n . Frege systems are basic in the sense that they are the most common in logic, and in that polynomial-length proofs in these systems naturally correspond to “polynomial-time reasoning” about feasible objects. In a sense, Frege is the proof-complexity analog of the computational class P71. The major open problem in proof complexity is to ﬁnd any tautology (as usual we mean a family of tautologies) that has no polynomial-size proof in the Frege system. Open Problem 6.10. Prove superpolynomial lower bounds for the Frege system.

As lower bounds for Frege are hard, we turn to subsystems of Frege which are interesting and natural. The most widely studied system is Resolution. Its importance stems from its use by most propositional (as well as first order) automated theorem provers, often called Davis–Putnam or DLL procedures [DLL62]. This family of algorithms is designed to find proofs of Boolean tautologies, arising in diverse computer science applications such as verification of software and hardware designs and communication protocols, to automatic generation of proofs of basic number theory and combinatorial theorems. The lines in Resolution refutations are clauses, namely disjunctions of literals (like x1 ∨x2 ∨¬x3). The cut rule in Frege simplifies here to the resolution rule: • Resolution rule: Use clauses A ∨ x and B ∨ ¬x to derive the clause A ∨ B.

A Resolution refutation starts with a set mutually unsatisfiable clauses (axioms) and derives the empty clause (a contradiction) via repeated application of the resolution rule above. The size of a Resolution proof may be taken simply as the number of clauses in the proof (as no disjunction has size larger than n). Note that Resolution is the restriction of Frege in which one is only allowed to use the simplest type of formulae, namely clauses, as lines in the proof. Figure 16 below describes a refutation, expanded as a tree, of the contradiction φ of Figure 13, in the Resolution proof system. Historically, the first major result of proof complexity was Haken’s72 [Hak85] exponential lower bound on Resolution proofs for the pigeonhole principle. n+1 Ω(n) Theorem 6.11 [Hak85]( PHP n ) requires Resolution proofs of size 2 . To prove this theorem, Haken developed the bottleneck method, which is related to both the random restriction method and approximation method mentioned in the circuit complexity Section 5.2. This lower bound was extended by Chvátaland Szemerédito random tautologies in [CS88]. A bit more precisely, they proved that picking sufficiently many clauses at random not only renders them mutually unsatisfiable with high probability, but also demonstrating this unsatisfiability will almost surely require exponentially large Resolution proofs. The width method developed by Ben-Sasson and

70This is simple over the binary ﬁeld, and with appropriate representation applies to other ﬁelds as well. 71A variant of Frege, called Extended-Frege, operates with circuits instead of formulae as lines in the proof (with similar derivation rules), and may perhaps better capture polynomial time reasoning. 72Armin Haken, the son of Wolfgang Haken cited earlier for his work on knots and the 4-color theorem.

83 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

¬x x

¬x V y ¬y ¬y x V y A3 A3

¬x V w ¬w V y x V y V z ¬z V x A1 A2 A4 A5

Figure 16: A tree-like Resolution refutation of φ

Wigderson in [BSW99] unifes and provides much simpler proofs of these and other results. More- over, it uncovers the role of graph expansion (discussed in Section 8.7) in many proof complexity lower bounds. The question of eﬃciently ﬁnding short Resolution proofs when they exist, namely how automatizable is this system, is extremely interesting due to its prevalent use for automated theorem proving. The best known bounds (respectively in [BKPS02√ ,AR01]) are that size s Resolution proofs for tautologies on n variables can be found in time exp( n log s), but under a natural complexity assumption must take time at least slog n. Can any of them be improved to narrow this wide gap?

6.4 Proof complexity vs. circuit complexity These two areas look like very different beasts, despite the syntactic similarity between the local evolution of computation and proof. To begin with, the number of objects they care about differs drastically. There are doubly exponentially many functions (on n bits), but only exponentially many tautologies of length n. Thus, a counting argument shows that some functions (albeit non- explicit) require exponential circuit lower bounds (Theorem 5.6), but no similar argument can exist to show that some tautologies require exponential size proofs. So while we prefer proof-length lower bounds for natural, explicit tautologies, even non-constructive existence results of hard tautologies for strong proof systems are interesting in this setting as well. Despite the different natures of the two areas, there are deep connections between them. Quite a few of the techniques used in circuit complexity, most notably Random Restrictions, were useful for

84 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

proof complexity as well. The lower bound of Pudlak on Cutting Planes which we saw in Theorem 6.7 uses circuit lower bounds in an extremely intriguing way: a monotone circuit lower bound directly implies a (non-monotone) proof system lower bound! This particular type of reduction is known as the “Feasible Interpolation Method” (that may be viewed as a quantitative version of Craig’s interpolation from first-order logic) we define next. A proof system has feasible interpolation if whenever it proves in size s a tautology of the form F (x, y) ∨ G(x, z) (in disjoint sets of variables x, y, z) is a tautology, then there is a Boolean circuit of size poly(s) on inputs x, which identifies whether F or G is a tautology when these x variables are so fixed (of course, at least one of them must be, and it is possible that both are, in which case any output is good). The feasible interpolation method was introduced by Krajicek [Kra94] and (more implicitly) by Razborov [Raz95a] for proving Resolution lower bounds. They noticed that for appropriate tautologies, the small circuit guaranteed by feasible interpolation can be made monotone. Hence monotone lower bounds on circuits can be used for Resolution lower bounds. This method was first used for Cutting Planes by [BPR97], and is known for other relatively weak proof systems. We note that feasible interpolation is a weaker property than automatizability discussed above, and so also the algebraic systems NS and PC have it. However, the reader should check that if feasible interpolation holds for every propositional proof system, then N P ∩ coN P ⊆ P/poly (and so, we do not expect it of strong proof systems). Indeed, Krajicek and Pudlak [KP89] show that if feasible interpolation holds for the standard Frege system, then Integer Factoring is easy (and more generally, many one-way functions 4.5 do not exist). This connection raises the question of whether one can use reductions of a similar nature to obtain lower bounds for strong systems (like Frege), from (yet unproven) circuit lower bounds. Open Problem 6.12. Does N P 6⊆ P/poly imply superpolynomial Frege lower bounds? Why are Frege lower bounds hard? The truth is, we do not know. The Frege system (and its relative, Extended Frege), capture polynomial-time reasoning, as the basic objects appearing in the proof are polynomial-time computable. Thus, superpolynomial lower bounds for these systems are the proof complexity analogues of proving superpolynomial lower bounds in circuit complexity. As we saw, for circuits, we at least understand to some extent the limits of existing techniques, via Natural Proofs. However, there is no known analogue of this framework for proof complexity. We conclude with a tautology capturing the P/poly vs. NP question. The proof complexity of this tautology may further illuminate why proving circuit lower bounds is difficult. This tautology, suggested by Razborov [Raz95b, Raz96], simply encodes propositionally the statement N P 6⊆ P/poly, namely that SAT does not have small circuits. More precisely, fix n, an input size to SAT, and s, the circuit size lower bound we attempt to prove73. The variables of our s s “Lower Bound” formula LB n encode a circuit C of size s. The formula LB n simply “checks” that the function computed by C disagrees with SAT on at least one instance φ of length n. Namely, that either φ ∈ SAT and C(φ) = 0 or φ 6∈ SAT and C(φ) = 1. Note that the description of this s O(n) tautology LB n has size N = 2 , so we seek a superpolynomial in N lower bound on its proof length74. s Proving that LB n is hard for Frege will in some sense give another explanation of the difficulty of proving circuit lower bounds. Such a result would be analogous to the one provided by Natural Proofs, only without relying on the existence of one-way functions. But paradoxically, the same

73E.g. we may choose s = nlog log n for a superpolynomial bound, or s = 2n/1000 for an exponential one. 74Of course, if N P ⊆ P/poly then this formula is not a tautology, and there is no proof at all.

85 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

inability to prove circuit lower bounds seems to prevent us from proving this proof complexity lower bound! s Even proving that LB n is hard for Resolution has been extremely diﬃcult. It involves proving hardness of a weak pigeonhole principle75—one with exponentially more pigeons than holes. After several partial results this was achieved with the tour-de-force of Raz [Raz04a], and the further strengthening by Razborov [Raz04b] (for the so-called “functional, onto” pigeonhole principle) s ﬁnally implies the hardness of LB n for Resolution.

75This explicates the connection we mentioned between the pigeonhole principle and the counting argument proving existence of hard functions.

86 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

7 Randomness in computation

The marriage of randomness and computation has been one of the most fertile ideas in computer science, with a wide variety of models ranging from cryptography to computational learning theory to distributed computing. It enabled new understanding of fundamental concepts such as knowledge, secrecy, learning, proof, and indeed, randomness itself. In this and the next section we shall just touch the tip of the iceberg, things most closely related to the questions of eﬃcient computation and proofs. The following two subsections tell the (seemingly) contradicting stories on the power and weakness of algorithmic randomness. Good sources are [MR95], [Gol99] and [Vad11]

7.1 The power of randomness in algorithms Let us start with an example, which illustrates a potential dilemma met by mathematicians who try to prove identities. Assume we work here over the rationals Q. The n × n Vandermonde matrix j−1 V (x1, . . . , xn) in n variables has (xi) in the (i, j) position. The Vandermonde Identity is: Q Proposition 7.1. det V (x1, . . . , xn) ≡ i

76This problem turns out to be even more fundamental that it may seem here. It is called the Polynomial Identity Testing problem (or PIT for short), is deeply related to arithmetic complexity theory, the subject of in Chapter 12. This problem is discussed at length e.g. in Section 4 of [SY10]. 77A general principle used here and throughout is that the access to random independent bits gives easy access to (essentially) uniform random samples from any ﬁnite range.

87 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

The deep issue of whether randomness exists in nature78 has never stopped humans from assuming it anyway, for gambling, tie breaking, polls and more. Perhaps nature provides some randomness (such as sun spots, radioactive decay, weather, stock-market fluctuations or internet traffic), but actual physical measurements of these unpredictable events do not produce perfectly independent and unbiased coin tosses. The question whether such weak sources of randomness can be used in probabilistic algorithms, and the theory developed for it, will be discussed in Chapter9. Here we postulate access of our algorithms to perfect coin flips, and develop the theory from this assumption.79 The presence of error in probabilistic algorithms seems like a serious issue—after all, we compute to discover a fact, not a “maybe.” However, we do tolerate uncertainty in real life (not to mention computer hardware and software errors) anyway, so it makes sense to allow it in algorithms as well. Moreover, observe that the error of a probabilistic algorithm is much more controllable than in other situations—here it can be decreased arbitrarily, with small penalty in efficiency. Assume our algorithm makes error at most 1/3 on any input (as the one above). For any algorithm with this property, running it k times, with independent random choices each time, and taking a majority vote of the answers, would reduce the error to exp(−k) on every input80. Thus we revise our notion of efficient computation to allow probabilistic algorithms with small error, and define the probabilistic analogue BPP (for Bounded error, Probabilistic, Polynomial time) of the class P. We note that one can (and does) define probabilistic analogs of other deterministic complexity classes and study the power of randomness in these settings as well. Definition 7.3 (The class BPP,[Gil77]). The function f : I → I is in BPP if there exists a probabilistic polynomial-time algorithm A, such that for every input x, Pr[A(x) 6= f(x)] ≤ 1/3. In the definition above we used A(x) to denote the random variable which is the output of the probabilistic algorithm A. Sometimes it is notationally more convenient to make explicit mention to the random bits used in the algorithm, namely consider A(x) as A0(x, r), where A0 is a deterministic algorithm, which besides the actual input x receives an auxiliary input r (of appropriate length) which is assumed to be a uniformly distributed sequence of random bits. In this notation, the 0 requirement in the definition can be written as Prr[A (x, r) 6= f(x)] ≤ 1/3 for a deterministic algorithm A0 which runs in polynomial time in |x|. We stress again that this probability bound in this definition is over the internal coin tosses r of the algorithm, and must hold for every input. This definition of BPP is extremely robust to changes of the error probability bound: replacing 1/3 by the lower 1/1010, or even exp(−|x|), as well as by the higher .49999 or even 1/2 − 1/poly(|x|), leaves the definition unchanged (this follows by the error-reduction via majority idea described above). Adleman [Adl78] observed that in probabilistic algorithms with such tiny error, some (indeed, most) random strings are simultaneously good for every input of a given length. Allowing non- uniformity, any of them can be hard-wired into a circuit which will compute correctly on every input. Thus, for any problem in BPP there exist small circuits81. 78What quantum mechanics says about it will be discussed in Chapter 11. 79 In practical implementations of probabilistic algorithms, these bits are usually generated by a variety of ad-hoc “pseudo-random generators”. It is a remarkable empirical fact that almost universally these ad-hoc alternatives to random bits seem to work pretty well. 80The notation exp(−k) means c−k for some c > 1. This bound on the error follows from standard concentration bounds on the binomial distribution, e.g. the Bernstein/Chernoff bound. Specifically, the probability that k tosses of a biased coin, whose probability of Heads is at most 1/3, would produce more than k/2 Heads, is exponentially small in k. 81Recall that in Chapter 5.2 we denoted the class of polynomial-size circuits by P/poly.

88 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Theorem 7.4 [Adl78] BPP ⊆ P/poly. Probabilistic algorithms were used in statistics (for sampling) and physics (Monte Carlo methods) before computer science existed. However, their introduction into computer science, starting with the probabilistic polynomial factoring algorithms of Berlekamp [Ber67] and the probabilistic primality tests of Solovay–Strassen [SS77] and Rabin [Rab80], was followed by an avalanche that increased the variety and sophistication of problems amenable to such attacks tremendously—a glimpse into this scope can be obtained e.g. from Motwani and Raghavan’s textbook [MR95]. We restrict ourselves here only to those which save time, and note that randomness seems to help save other resources as well! We list here a few sample problems which have probabilistic polynomial time algorithms82, but for which the best known deterministic algorithms require exponential time. These are amongst the greatest achievements of this research area.

• Generating primes. Given an integer x (in binary), produce a prime in the interval [x, 2x] (note that this interval is exponentially long in the input length |x|). The prime number theorem guarantees that a random number in this interval is a prime with probability about 1/|x| (so one will show up in polynomial time in |x| with high probability, and we can check their primality efficiently). • Polynomial factoring (Kaltofen [Kal83]). Given an arithmetic formula or circuit83 describing a multivariate polynomial (over a large finite field), find its irreducible factors84.

• Permanent approximation (Jerrum, Sinclair and Vigoda [JSV04]). Given a non- negative real matrix, approximate its permanent (deﬁned in Section 12) to within (say) a factor of 2. Note that unlike its relative, the determinant, which can be easily computed eﬃ- ciently by Gaussian elimination, the permanent is known to be #P-complete (which implies NP-hardness) to compute exactly.

• Volume approximation (Dyer, Frieze and Kannan [DFK91]). Given a convex body in high dimension (e.g. a polytope given by its bounding hyperplanes), approximate its volume to within (say) a factor of 2. Again, computing the volume exactly is #P-complete.

The most basic question about this new computational paradigm of probabilistic computation is whether it really adds any power to deterministic computation. Open Problem 7.5. Is BPP = P? The answer seemed to be negative: we have no idea in sight as to how to solve the problems above, and many others, by a deterministic algorithm running even in subexponential time, let alone in polynomial time. However, the next subsection should radically change this viewpoint, through the fundamental notion of computational pseudo-randomness.

82Strictly speaking, they are not in BPP as they compute relations rather than functions. 83See precise deﬁnitions in Chapter 12. 84It is not even clear that the output has a representation of polynomial length—but it does! A structural corollary of this result is that the factors have small arithmetic circuits as well.

89 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

7.2 The weakness of randomness in algorithms Let us start from the bottom line: if any of the numerous NP-complete problems we saw above is hard then randomness is weak. There is a tradeoff between what the words hard and weak formally mean. To be concrete, we give perhaps the most dramatic such result, due to Impagliazzo and Wigderson [IW97]. Theorem 7.6 [IW97] If SAT cannot be solved by circuits of size 2o(n), then BPP = P. Moreover, the conclusion holds if SAT replaced in this statement by any problem which cannot be solved by circuits of size 2o(n), but has 2O(n)-time algorithm85. Rephrasing, exponential circuit lower bounds on essentially any problem of interest imply that randomness can be always eliminated from algorithms without sacrificing efficiency (up to a polynomial). Many variants of this result, which is generally called de-randomization exist. One variant gives a hardness-randomness “trade-off”; weakening the assumed lower bound on the hard problem simply weakens the deterministic simulation of randomness, but leaves it highly nontrivial (namely, the resulting deterministic algorithm substituting the probabilistic one is far more efficient than brute force enumeration of the values for the random bits) . For example, if N P 6⊆ P/poly then BPP has deterministic algorithms with subexponential runtime exp(nε) for every ε > 0. Another important extension is replacing the non-uniform circuit lower bound by a uniform hardness assumption (of the type BPP= 6 NP). This results in an “average-case” derandomization, as was defined and proved in Impagliazzo and Wigderson [IW98]. Note one remarkable and counterintuitive feature of such results: they assert that if one computational task is hard, then another is easy! In light of the theorem above we are now faced with deciding which of two extremely appealing beliefs to drop (as they are contradictory!). The first is that some natural problems (e.g. NP- complete ones) cannot be solved efficiently. The second is that randomness is a very powerful algorithmic resource. Experience, intuition and state-of-art knowledge seem to support both, but they seem far stronger in supporting the first. Given that, most experts reluctantly drop the second, and now believe that randomness cannot significantly speed up algorithms. Namely, that probabilistic algorithms can be replaced by deterministic ones for the same task which are not much more costly—a statement which usually goes under the name de-randomization. We state it for classification problems (similar theorems for search and approximation problems are known as well, but we shall not discuss them here). Conjecture 7.7. BPP = P. We now turn to give a high level description of the ideas leading to this surprising set of results, which are generally known under the heading Hardness vs. Randomness86. The central notions that make this de-randomization possible are computational pseudo-randomness and pseudo-random generator. We explain both here, and see how they yield de-randomization. In the next subsection we will return to describe their history and importance, beyond de-randomization, and discuss different pseudo-random generators. We refer the reader to chapter 8 of Goldreich’s book [Gol08] and his monograph [Gol99] for more detail.

85The class with such algorithms includes most NP-complete problems, but also presumably far more complex ones, e.g. determining optimal strategies of games, which are PSPACE-complete, and beyond. 86The title of Silvio Micali’s PhD thesis, who, along with his advisor Manuel Blum, constructed the ﬁrst hardness- based pseudo-random bit generator.

90 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

We are after a general way of eliminating the randomness used by any (efficient!) probabilistic algorithm. Fix any such algorithm A. It has two kinds of inputs. The “real” input x, and the “randomness” y, which let us say is n bits long. The error guarantee is that for every x, if y is distributed according to the uniform distribution Un on all binary sequences of length n, then A(x, y) will err with probability at most 1/3. The idea is to “fool” A, replacing the distribution Un by another distribution D, which “looks like” Un to A. Put differently, A will not be able to distinguish D from Un on any input x. And more precisely, whether y is distributed according to Un or to D, on every x A(x, y) will accept with nearly the same probability. Let us first define distributions the can “fool” all efficient algorithms. We will later see that to actually use such distributions we need to make them useful, and discuss in which sense.

Computational pseudo-randomness The first key notion we define is computational pseudo- randomness87 of Goldwasser-Micali [GM84] and Yao [Yao82a]. For simplicity we shall define it here with respect to circuits. For a circuit C with n inputs and a distribution D on n-bit sequences, denote by C(D) the probability that C(y) = 1 when y is drawn from D. As usual, all definitions should be viewed asymptotically. In particular, when discussing a family of circuits C we will implicitly mean a sequence of circuits {Cn} parameterized by the input length n, with Cn typically restricted in size as a function of n. As in other places in this book, we will abuse notation and 88 omit n, e.g. identifying C with Cn when the parameter n is implicit . A schematic is in Figure 17 below.

Deﬁnition 7.8 (Pseudo-randomness). Let C be a family of circuits (on n bits), and > 0. A distribution D (on n bits) is called (C, )-pseudo-random, if for every C ∈ C we have |C(D) − C(Un)| ≤ .

C(D ) C(U ) n ≈ε n

C C

Dn Un

Figure 17: Schematic of a pseudo-random distribution Dn -fooling a circuit C.

In words, D is pseudo-random if no circuit in C can “tell it apart” from the uniform distribution, with “non-negligible advantage” . Equivalently, D -fools C.

87We often omit the “computational” and call it only “pseudo-randomness” in this chapter. 88Indeed, we may even change the number of inputs to be some polynomial in n without warning, when this does not aﬀect the argument.

91 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

The parameter can be a small constant (e.g. .01) for the purposes of this subsection, but in general may depend on n, with = (n) tending to zero with n, often like 1/poly(n). The class of circuits can be arbitrary, but for this subsection it is natural to take it to be P/poly, or even better, the family of circuits of some fixed polynomial size, say n4. The reason is that for every efficient algorithm we are trying to de-randomize, if it runs in time (say) n2, then a circuit can simulate its action on every n-bit input in time n4 (as we saw in chapter 5.2). As we seek deterministic emulation of probabilistic algorithms, we must find a pseudo-random distribution D which can be efficiently generated from 0 random bits. But this is clearly impossible, even if we remove the efficiency requirement, as randomness cannot be generated deterministically89. Luckily, we have some leverage. Let us instead try to generate such pseudo-random D on n bits from fewer random bits, say m. This leads us to the next important notion of a pseudo-random generator, stretching few, truly random bits into many pseudo-random ones, defined in the same paper of Yao [Yao82a].

Pseudo-random generators Deﬁnition 7.9 (Pseudo-random generators). Let C be a family of circuits. A function G : {0, 1}m → {0, 1}n is called a (C, )-pseudo-random generator if, on uniformly random input, its output distribution G(Um) is (C, )-pseudo-random. A schematic is shown in Figure 18. In this deﬁnition we again think asymptotically, parametriz- ing everything by n, the length of the random input in circuits/algorithms we want to fool (which m(n) is also the output length of the generator). So G should be a family of functions {Gn : {0, 1} → n {0, 1} } which fools circuits from Cn with error (n).

C(D ) C(U ) n ≈ε n

C C

Dn=G(Um) Un

Figure 18: Schematic of a pseudo-random generator G -fooling a circuit C.

89The output of a deterministic process on a ﬁxed input is, well, completely determined.

92 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Pseudo-random generators can be used to fool uniform probabilistic algorithms, as their execution on each input can be simulated by circuits (see Chapter 5.2). For example, if we have such a 4 1 pseudo-random generator G with C being the class of size n -size circuits, and with = 20 (say), 2 then we can use D = G(Um) to fool any probabilistic n -time algorithm A on every input x for it. 1 1 2 For by definition, the error of the algorithm under this distribution would be at most 3 + 20 < 5 , 1 which is crucially (as we shall presently see) bounded away from 2 . But we don’t have m random bits to generate D, as we aim for a deterministic algorithm. One simple, brute-force90 way to get a deterministic emulation is to go over all possible sequences z ∈ {0, 1}m, compute y = G(z) for each, and use the algorithm A with randomness y (namely, compute A(x, y) for each such y). After getting all these 2m results we take their majority vote, and declare it our answer for x. Note that this deterministic procedure will always give the correct 1 answer, for every input x (again, this is true since less than 2 in the support of D causes an error, and we take a majority vote over the whole support). The running time of this de-randomized algorithm depends on two factors: 2m and the time complexity of G (indeed on their product). Let us deal with them in turn. First, a fairly standard counting argument shows that there exists a function G with m = O(log n) that is a (C, )-pseudo- random generator. Indeed, a random G will have this property with very high probability. So, 2m can be polynomial in n, which takes care of the first factor. However, a random G will typically be exponentially hard to compute. What we are looking for is a generator G that can be computed efficiently, in polynomial time. This would make the second factor polynomial as well, and will yield a polynomial time emulation of BPP. Are there such efficient pseudo-random generators? This is exactly what Theorem 7.6 provides, assuming that a sufficiently hard function exists91. This conversion of hardness into pseudo-randomness is also discussed in the next subsection.

7.3 Computational pseudo-randomness and pseudo-random generators We now explore the history and signiﬁcance of these two central notions. The previous subsection presented them as extremely natural for the purpose of de-randomizing probabilistic algorithms. And indeed they are. However, this is not the way they were born. Let us discuss them in turn.

Pseudo-randomness, computational indistinguishability and cryptography The concept of computational pseudo-randomness is actually an (important) special case of a much broader notion, that of computational indistinguishability, defined earlier by Goldwasser and Micali [GM84] (this paper will be further discussed at length in Chapter 18). It deems two probability distributions computationally indistinguishable if no efficient procedure can tell them apart. Definition 7.10 (Computational indistinguishability). Let C be a family of circuits. Two distributions D and D0 on n bits are called (C, )-indistinguishable, if for every C ∈ C we have |C(D) − C(D0)| ≤ .

Observe that D is pseudo-random iff D and Un are indistinguishable. The motivation for this definition was cryptography (for a comprehensive text see Goldreich [Gol04]), and we briefly describe it. In that seminal paper [GM84] Goldwasser and Micali set the formal mathematical foundations

90But useful if m is very small. 91It is a good exercise to convince yourself that a hardness assumption is needed. Hint: consider the complexity of determining if a given n bit sequence is in the image of G, and argue that if G is a pseudo-random generator then this function must be hard.

93 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

of the field. To illustrate the utility of computational indistinguishability, consider the most basic notion in cryptography, a secret. But what is the right definition of secrecy, and how can one achieve it? Goldwasser and Micali propose the fundamental notion of probabilistic encryption which enables hiding even a single bit, as follows. Their miraculous encryption scheme assigns to each of the bits 0 and 1 probability distributions D0 and D1 on n bits, with the following two, seemingly contradictory properties. First, they have disjoint supports, so clearly completely distinguishable from an information theoretic perspective. Second, they are computationally indistinguishable, so look identical to efficient observers. [GM84] show that not only is that possible, but also how to efficiently generate these distributions. The beauty is that by definition no efficient process can 1 even guess the secret bit with probability better than 2 + . More generally, it allows encryption of longer messages in a way that ensures no leakage of any partial information. Computational indistinguishability allows the designer of encryption schemes to completely ignore various details about the specific types of adversaries attacking the system, and consider only limits on their computational abilities. Some of you may be wondering at this point how this can be useful for encryption, if no one can tell what the secret is. Well, their construction also crucially provides a trap-door which allows “appropriate parties” (with extra knowledge) to be able to tell the two distributions apart efficiently, and decrypt encrypted messages. All this magic relies on a “cryptographic hardness assumption”, like one-way functions or trap-door functions mentioned in Section 4.5, which in the paper [GM84] happens to be a variant on the hardness of integer factoring. More precisely, and pertaining to a major theme of this book, what [GM84] supply is a new type of reduction. They prove that 1 breaking this encryption scheme (namely guessing the secret with probability at least 2 + from its encryption) will imply a faster algorithm than the hardness assumption allows (e.g. will provide a much faster factoring algorithm than is currently known). The power of viewing adversaries of cryptographic protocols as computationally bounded entities, and using computational indistinguishability to prove them powerless is just beginning to be revealed in this example. The paper goes on to develop formal definitions of security of cryptographic protocols which rest on these principles, and they underly practically every one of the literally thousands of cryptography papers which define and prove properties of cryptographic primitives and protocols. One such example, zero-knowledge proofs, is informally explained in Chapter 10.2 and formally relies on computational indistinguishability. Needless to say, the focus on computational complexity when classifying adversaries fits perfectly with the web of reductions between these numerous primitives and properties, and allows resting them on mathematically clean and far better tested hardness assumptions. Observe the flexibility of the computational indistinguishability definition. It allows any class of adversaries (also called observers, or distinguishers, or tests) C, and indeed different settings invite different classes. One particularly interesting class is the one of all circuits, or equivalently all Boolean functions. What does computational indistinguishability of D and D0 mean in this case? Simply, It means that for every Boolean function f we have |f(C) − f(D0)| ≤ , which simply bounds the statistical distance of these two distributions (namely one half of the L1-norm of their 1 0 difference): 2 |D − D |1 ≤ . This illustrates that restricting the class of observers gives a certain coarsening of the L1 metric! It allows two distributions on disjoint supports to be very close in this new metric, and in the previous section we saw that it allows distributions of very different entropies to be very close in this metric (despite the fact that in both cases the statistical distance is maximal, essentially 1). This dichotomy between the information theoretic and computational complexity settings is the heart of modern cryptography, and will be highlighted again in Chapter 18.

94 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Let us make one more crucial point. Randomness, the hero of this section, has been used by humans for millennia, and been studied by mathematicians and scientists for centuries. There are various approaches, views and theories of randomness, in probability theory, statistics, statistical physics, information theory, ergodic theory, chaos theory, Kolmogorov complexity, and indeed, philosophy. This new theory of computational randomness diﬀers from them all in a fundamental aspect. In all past approaches, qualitative or quantitative, the randomness of a phenomenon (be it a coin toss or stock-market ﬂuctuation or a DNA sequence), is an objective property of the phenomenon itself. In computational pseudo-randomness, it is subjective, a property of the observer! The very same (objective) phenomenon, e.g. the same pseudo-random distribution (even a single coin toss), can be deemed random by a computationally limited observer, and deemed not random by an observer without computational limitations.

Pseudo-random generators from hard problems For this section, the readers may want to refresh their memory of Chapter 4.5 regarding one-way and trap-door functions. The phrase “pseudo-random generator” (or PRG for short) was in use decades before these developments. It was used to describe any ad-hoc method (particularly those used in practice in a variety of systems and algorithms which need random bits) for deterministically stretching a short sequence into a longer one. Theoretical interest in proving general properties of the output distribution of PRGs probably started with von Neumann [vN51] and his early computer (which needed random bits for Monte-Carlo simulations and weather prediction). A famous quote of von Neumann on the subject is “Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin.” As is well known, von Neumann ignored his own advice, as shall we92. The idea of constructing pseudo-random generators from hard computational problems developed in a meandering evolution of works. We now recount some of the main ideas, different motivations and consequences of these works. This high level description is necessarily sketchy; for more detail see e.g. [Gol99,Gol04,Vad11]. The computational complexity methodology of computational abstraction and efficient reductions, as well as the interconnectivity of areas within computational complexity come out powerfully in this story. The first complexity-based definition of a pseudo-random generator was given by Shamir [Sha83]. Again, his motivation was cryptography. He argued that if one user is generating a sequence which another user can predict, security and privacy may be violated. He called generators whose output distribution is unpredictable cryptographically strong, and suggested a design to base this property on a one-way function. Shamir’s plan was fully executed by Blum and Micali [BM84]. They formally defined unpredictable generators, in which no successive output bit can be non-trivially 1 guessed (with probability > 2 + ) given its predecessors, by any efficient observer (in some class C). Let us state these definitions of (left-to-right) unpredictable distributions and generators more precisely. For a distribution D let us denote by Dk its projection on the kth bit, and by D[k] its projection on the first k bits. Definition 7.11 (Pseudo-random generators). Let C be a family of circuits. • A distribution D on n bits is called (C, )-unpredictable (in left-to-right order), if for every 1 i ∈ [n] and every C ∈ Ci−1 we have Pr[C(D[i−1]) = Di] ≤ 2 + . 92Another famous early quote on the subject is the title of Coveyou’s paper [Cov69]: Random number generation is too important to be left to chance.

95 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• A function G : {0, 1}m → {0, 1}n is called a (C, )-unpredictable generator if, on uniformly random input, its output distribution G(Um) is (C, )-unpredictable. Blum and Micali showed how to construct such efficient unpredictable generators G based on the hardness of the discrete logarithm function (discussed as a one-way function candidate in Chapter 4.5). The conceptual message here is that some hardness assumptions can guarantee an efficient generation of distributions with a strong pseudo-random property, unpredictability, against any efficient observers. Does this get us closer to our goal, a pseudo-random generator? What is the relation between unpredictable distributions and pseudo-random ones? For example, if a distribution is unpredictable from left-to-right (as above), is it unpredictable also in the other direction? Try to think about it before reading further. The answer is ‘yes’! The next paper in the sequence, by Yao [Yao82a] proved that every unpredictable distribution is pseudo-random. More precisely, if D is (C, )-unpredictable, then it is also (C0, 0)-pseudo-random, with circuits in C0 a little smaller than in C, and with 0 a little larger than . This immediately implies that the Blum-Micali generator is a pseudo-random generator, based on the hardness of the discrete logarithm. Yao extends this in the same paper to the wide class of one-way permutations93. Finally, Yao makes the connection between pseudo-random generators and de-randomization, giving the first (highly) non-trivial de-randomization of BPP under natural hardness assumptions! Theorem 7.12 [Yao82a] If one-way permutations exist, then for every > 0, every problem in BPP can be solved deterministically in deterministic time exponential in n. Pseudo-random generators based on one-way functions are often called cryptographic generators, sometimes BMY-generators after their inventors. These generators are extremely efficient (in a sense we’ll explain soon), more than necessary for de-randomization94, but is crucial for cryptographic applications. Recall that a one-way function is easy to compute but hard to invert, e.g. modular exponentiation, whose inverse, the discrete logarithm, is assumed hard. This dichotomy is used as follows. The efficiency of the generator depends on the complexity of the easy direction of the function. The class of observers to which its output is pseudo-random depends on the complexity of the hard direction. Thus, this generator can run in polynomial time, and can potentially (depending on the assumed strength of the one-way function) withstand super-polynomial or even sub-exponential time attacks. This is crucial for cryptography, where typical users with their laptops are far weaker than potential adversaries, like companies, governments or criminals with far larger computational resources. But this ability of cryptographic PRGs to fight stronger adversaries also leads to more conceptual implications which we will now discuss. First, it is easy to see that a cryptographic PRG implies the existence of one-way functions, almost by definition (inverting it on a sufficiently long part of the output would allow perfect prediction of the rest). Yao proved that one-way permutations imply such PRGs, and a sequence of works culminating in a paper by H˚astad,Impagliazzo, Levin and Luby [HILL99], closed this gap. They proved that the two notions are equivalent: one-way functions exist iff cryptographic PRGs do! So, in the cryptographic setting, the most natural hardness assumption and the most natural pseudo-randomness notion coincide! Theorem 7.13 [HILL99] The following are equivalent

93This is simply a one-way function which happens to be a permutation. Both examples from Chapter 4.5, modular exponentiation and modular powering, are indeed permutations. 94We will soon contrast this with another construction designed speciﬁcally for de-randomization.

96 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• There exist one-way functions • There exists a poly(n)-time computable (P/poly, 1/poly(n))-generator G : {0, 1}m → {0, 1}n for any n = poly(m). Note that an immediate corollary is the same de-randomization consequence of the above The- orem 7.12 under the (seemingly) weaker assumption of the existence of one-way functions. Further important consequences of the existence of one-way functions follow from a work of Goldreich, Goldwasser and Micali [GGM86], who constructed pseudo-random functions. This is a family of functions which are all easy to compute, but a random one of them cannot be told apart from a truly random function, by any efficient observer who can query it at any sequence of (adaptively chosen) inputs95. Pseudo-random functions are an extremely strong cryptographic primitive! Besides their obvious utility in a variety of cryptographic settings, let us mention two other applications. One consequence of this notion was mentioned in Section 5.2.4—it is essential to the result that natural proofs of circuit lower bounds would imply efficiently inverting of any one-way function. The second consequence relates to computational learning theory. A central question there is what classes of functions can be efficiently learned from adaptive observations (this notion of learning captures e.g. the acquisition of concepts by children, the development of the visual system by evolution, etc.). Pseudo-random functions, by definition, cannot be learned in this sense, as their value at any new input looks completely random to the (efficient) learner. This implies the following, far-from-obvious fact: some functions are easy to compute, but hard to learn. The ability to de-randomize probabilistic algorithms by assuming hardness gave computational complexity a new toy (which indeed became popular): for weak computational models we do have lower bounds, which perhaps can be turned into unconditional pseudo-random generators against them, and unconditionally de-randomize the respective probabilistic classes. One natural candidate was constant-depth circuits, where exponential lower bounds were known, by H˚astad [H˚as89], e.g. for the Parity function. Nisan [Nis91b] proposed a new design of an unconditional pseudo-random generator based on Parity and its known hardness. This in turn inspired Nisan and Wigderson [NW94] to develop a new conditional generator, sometimes called the NW-generator. Their main motivation was weakening the hardness assumptions needed for de-randomizing classes like BPP. As discussed above, the BMY-generators achieve this assuming the existence of one-way functions. If there are no one-way functions, this is a fatal blow to cryptography, but it does not rattle the complexity world much; it leaves e.g. NP-complete problems intact (and hard). And indeed, NW-generators can utilize even this (less structured) hardness. [NW94] shows how to de-randomize BPP even assuming the (average-case) hardness e.g. of NP-complete problems. In fact, [NW94] prove a much stronger statement. Any function that small circuits cannot approximate, which has an exponential time algorithm, yields a pseudo-random generator. Moreover the construction of the (pseudo-random) generator from the (hard) function is a generic, black-box construction96. A schematic description of how an NWf generator is constructed from a given function f is depicted in Figure 19 below. This general result offers a trade-off between the assumed difficulty of the function and the quality of the resulting generator. We state here only one extreme choice of parameters, to contrast with Theorem 7.13 above. Note that the great relaxation in the hardness assumption is paid by the running time of the generator (whose stretch and quality do not change). As we shall presently

95This may be viewed as a pseudo-random generator with exponentially-long output (namely the truth table of the function), every bit of which is eﬃciently computable, and which the adversary can query in arbitrary locations. 96This notion means that the construction accesses the function simply by requesting its values on diﬀerent inputs, and is completely independent of the way it might be computed.

97 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

1 2 … i … j … n

NW f f f

1 2 … m

Figure 19: Schematic of NWf . Essentially, the n outputs are obtained by applying f to n diﬀerent subsequences (with small pairwise overlaps) of the m-bit long input sequence. see, this has no eﬀect on de-randomization. Theorem 7.14 [NW94] The following are equivalent: • There are exponential time computable functions that cannot be approximated by polynomial- size circuits. • There exists an exp(m)-time computable (P/poly, 1/poly(n))-generator G : {0, 1}m → {0, 1}n for any n = poly(m).

Moreover, instantiating the NW-generator with a function that cannot be approximated by exponential size circuits yields a generator of exponential stretch. As it turns out, this generator provides a nontrivial de-randomization of BPP, despite the exponential running time of the generator. The key observation allowing this is that when using PRGs for de-randomization, one anyway enumerates over all 2m possible “seeds” of the generator. So we might as well allow, “for free”, that the hard function be computable in 2m-time (rather than e.g. demand that it is in P), without slowing down the overall deterministic simulation time. The main weakness of the NW-generator compared to the BMY-generator is that it needs more computation time than the adversaries testing the pseudo-randomness of its output. So it is useless for most cryptographic applications. However, for de-randomization purposes, we can aﬀord it, as the generator is only polynomially slower than the adversaries, and e.g. for BPP would still run in polynomial time. There are several advantages of the NW-generator compared to the BMY-generator. The main one of course is that it allows seemingly much more believable hardness assumptions, e.g. of functions complete for NP and even much higher complexity classes. Another advantage is the generic way in which the hard function is used in the generator—the output bits of the generator are simply evaluations of the hard function on many diﬀerent, carefully chosen subsets of input bits. This generic construction immediately allows us to de-randomize practically any reasonable class of probabilistic algorithms (in other computational models with other resource bounds), assuming a hard function for the class of circuits they correspond to. The

98 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

NW-generator has found also far less obvious applications and extensions, e.g. in randomness extraction [Tre99] (mentioned in Chapter9), arithmetic complexity [KI04], probabilistically checkable proofs (PCPs) [HW03], and others. The “optimal” hardness vs. randomness trade-off, Theorem 7.6 of Impagliazzo and Wigder- son [IW97] from the beginning of this section, is based on the NW-generator but still needs quite a bit of work beyond it. We mention only one aspect of it. The assumption in this theorem is a standard, worst-case complexity assumption, whereas both the original BMY and NW generators used average-case assumptions. The conversion between the two, called hardness amplification, transforms any worst-case hard function to one which is hard on the average, and then transforms this one further to another whose output is essentially unpredictable on a random input. The main tools for hardness amplification are arithmetization97 and the XOR Lemma (see history, several proofs and references in the survey [GNW11]). Getting the optimal parameters for this conversion required a “de-randomization” of such hardness amplification results. Doing so entails building new pseudo-random generators for entirely different purposes than fooling algorithms. This illustrates how concepts like pseudo-randomness evolve and get a life of their own, a phenomenon with many incarnations. Such a pseudo-random generator was designed in [IW97], and led to Theorem 7.6. So far, we have described a “black-box” attack on the de-randomization problem. One pseudo- random generator is supposed to simultaneously de-randomize all probabilistic algorithms from a class, without even looking at them, just using their input-output relation! As might be suspected, this very general pseudo-randomness line of attack is a paradigm that benefits from specialization. We saw that to de-randomize a probabilistic algorithm all we need is a way to efficiently generate a low-entropy distribution which fools that algorithm only, on every input of course. For a specific, given algorithm, this may be easier than fooling simultaneously all algorithms. Indeed, such “white box” approach, of careful analysis of some important probabilistic algorithms and the way they use their randomness, has enabled making them deterministic via tailor-made generators, without any unproven hardness assumptions. These success stories (of which the most dramatic are the recent deterministic primality test of Agrawal, Kayal and Saxena [AKS04] and the log-space algorithm for undirected graph connectivity of Reingold [Rei08]) actually suggest the route of “probabilistic algorithms followed by de-randomization” as a paradigm for deterministic algorithm design. Many more basic examples of such de-randomization of specific algorithms can be found in Motwani and Raghavan’s textbook [MR95]. However, we note that for some problems we cannot expect to eliminate a hardness assumption, even trying to de-randomize specific algorithms for them! The remarkable result of Kabanets and Impagliazzo [KI04] shows that even de-randomizing the simple probabilistic algorithm embodied in Proposition 7.2 above implies certain nontrivial circuit lower bounds. So, hardness and randomness are far more intertwined than anyone expected. Indeed, for the related problem of de-randomizing probabilistic proofs98,[IKW02] show that seeing the algorithm doesn’t help: white-box de-randomization is equivalent to a black-box one! We conclude by stressing that randomness remains indispensable in many fields of computer science, including cryptography, distributed computing, and—as we shall see in a few chapters— probabilistic proofs. Moreover, even if BPP = P, probabilistic algorithms may be simpler and faster. For example, the best known probabilistic primality test takes less than O(n3) time, while the best known deterministic one requires time Ω(n5). In light of all these applications, it is a great question to ponder if perfect randomness as demanded in these applications exists in the real world,

97This refers to the encoding of Boolean functions as polynomials, an idea developed in the areas of program testing and interactive proofs (some mentioned in Chapter 10.1) 98We shall meet many types of these in Chapter 10

99 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

and which of these applications survive if it doesn’t. We will return to this question in Section9.

100 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

8 Abstract pseudo-randomness

In the previous chapter we saw how the notion of computational pseudo-randomness was essential for understanding the power of probabilistic algorithms. Indeed, this notion and its variations, as well as the more general notion of computational indistinguishability, have had a huge impact on many aspects of computational complexity, including circuit complexity, computational learning theory, and of course cryptography, where it underlies most definitions and results. Now we will extend this notion considerably, indeed take it to its logical conclusion. Rather than consider indistinguishability of distributions from a family of computationally bounded observers, we’ll simply allow arbitrary families of observers. We will call a property of (any) universe of objects “pseudo-random”, with respect to any such family, if these observers cannot tell apart a random object with the property, from a random object from the whole universe. Perhaps surprisingly, this will turn out to be extremely useful! Pseudo-randomness in this general sense is a large and growing area of interaction between the theory of computation and mathematics. In this chapter we will motivate its study from the (different) viewpoints of both fields, give many examples of pseudo-random properties, define this notion in full generality, and raise the question of explicitly exhibiting and certifying pseudo-random objects. We will see that central questions in both fields, including the Riemann Hypothesis and the P vs. NP question, can be cast very naturally in this language of pseudo-randomness. We will then discuss the emerging proof technique of “structure vs. pseudo-randomness”, which already had many applications in diverse areas, but whose power is only beginning to unfold. Let us start with a few simple examples of pseudo-random properties. These will serve also to highlight a related topic, the probabilistic method (for an excellent text, see Alon and Spencer [AS00]). This method proves the existence of objects having desired properties, without explicitly describing them. This technique was first used in the late 1940s in two independent papers. One is by Erd˝os[Erd47], proving the existence of Ramsey graphs (and initiating modern Ramsey theory), and one is by Shannon [Sha48], proving the existence of good error-correcting codes (and inaugurating information theory). Further examples of Erd˝osclarified the power of this technique. The essence of this method is (cleverly) picking a universe of objects U, and proving that a random object in U has the desired property with positive probability (indeed, in most cases, almost surely). Observe that the correctness proof of every probabilistic algorithm has essentially this structure—proving that almost all choices of coin-flips will lead the algorithm to the correct result.

8.1 Motivating examples We give three examples of pseudo-random properties. For each, consider the challenge which will occupy us below—to explicitly exhibit objects with these properties. We start with two examples99 from Ramsey theory (see Graham, Rothschild and Spencer [GRS90]). The prototypical “meta-theorem” of this area is that, in every “large enough” system, there must be a non-trivial part which is very “structured”. The quantitative aspect is how large can this subsystem be. Ramsey graphs. A graph on n vertices is called r-Ramsey if it contains no clique nor an independent set of size r. In other words, every subset of r vertices has at least one pair connected by

99While combinatorial in nature, the origins of both examples is in ﬁrst-order logic, the ﬁrst leading to a decidability result in Ramsey’s original paper [Ram30], and the other to extension theorems and 0/1-laws.

101 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

an edge, and another pair which is not. Erd˝os[Erd47] proved that almost every graph on n vertices is (3 log n)-Ramsey100. Weak tournaments. A tournament is a directed graph in which every pair of vertices has a directed edge between them (e.g. describing the winner of pairwise games in a real tournaments). A set of vertices (players) is called dominating if every other player lost to at least one of them. A tournament on n vertices is called w-weak if it contains no dominating set of size w. Erd˝osproved 1 101 that almost every tournament is ( 3 log n)-weak . Next, we turn to coding theory, which underlies our ability to handle noise in digital communication and media storage.

n Good codes. A subspace V of dimension (say) n/10 over F2 is a distance-d linear code if every two vectors in V diﬀer in at least d coordinates. Following Shannon, Varshamov [Var57] proved (via a simple probabilistic argument) that almost every such subspace is a distance-n/10 linear code102.

8.2 General pseudo-random properties, and finding hay in haystacks Let us abstract from the examples above. We have a finite universe of objects U. In the examples above these are all graphs, tournaments or subspaces, respectively. A property is simply a subset S ⊆ U (an element x ∈ U has the property S if and only if it belongs to S). The properties above are being r-Ramsey, w-weak, or distance-d, respectively. In all three cases, particular choices of the relevant parameter define properties, which hold for almost every object in the respective universe. Note that in all examples, each property was defined by a collection of many “basic tests”, which may be viewed as a family of observers. Each of these tests is satisfied with extremely high probability for a random103 object in U (and typically the proof that all of them are satisfied follows from a union bound). In the first two examples each such test involves only a small subset of the vertices, and in the third example each test involves one pair of vectors. This locality, or simplicity, or “low complexity” of basic tests, which measures how “random looking” an object is, will be typical in many other examples below. We will generally say that the property S is pseudo-random if it contains almost all elements of U. The reason for this name is simply that a random element of U satisfies S almost surely.

Deﬁnition 8.1 (Pseudo-random property). A property S ⊂ U is -pseudo-random if |S| ≥ (1 − )|U|. So a pseudo-random property is simply a large set. In particular, it is clear what to do if you need an object with a particular pseudo-random property—simply pick an object in U at random, and it will have the required property with high probability. Things get interesting when we want to deterministically obtain one. In many cases, it is even diﬃcult to certify that a given object has the property. As usual, we’ll think asymptotically, U and S will be families, U = {Un} and S = {Sn}. Furthermore, as in the examples above, Un will typically have size exponential in n, so a brute-force search is prohibitive (whereas the description of any particular object takes only

100 1 This result is nearly tight. No graph can be ( 2 log n)-Ramsey 101This result is nearly tight. No tournament can be (log n)-weak. 102This result is nearly tight. No such subspace has distance n/3. 103We implicitly use the uniform distribution over the set U. Much of the theory and applications work also with other, and sometimes all, choices of distribution over U. Indeed, in some cases this applies also to inﬁnite universes endowed with appropriate probability measures.

102 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

poly(n) bits). The value of , typically unspecified, can be taken to be a small constant, or (as in the examples above) a function (n) which tends to 0 as n increases. This general setting turns out to capture a host of problems in a surprising variety of areas in mathematics and in the theory of computation. In both fields, for a variety pseudo-random properties S ⊆ U, the same questions arise. Does a (mathematically natural) object x0 ∈ U satisfy S? Can we efficiently describe some object x in S? Beautifully conveying the essence of such a challenge, Howard Karloff describes it as finding hay in a haystack! In many of these problems, despite the abundance of hay, known efficient algorithms may produce only needles. However, this quest for hay is well rewarded! In the following subsections we will try to establish the generality and importance of this pseudo- randomness phenomenon in Math and CS through a series of examples. Before doing so, we review the three examples of pseudo-random properties above (in reverse order), check that they suit the general framework, and consider the status of these questions for them. In all three examples the 2 objects in the respective universes Un can be encoded by about n bits (and so these universes have size exp(n2)). Good codes. Shannon’s seminal paper [Sha48] left open how to explicitly describe good codes. The search for hay in this haystack is compounded by the fact that in practice, not only do we want a good linear code, but we need to have efficient encoding and decoding algorithms for it. The study of this collection of questions created the field of Coding Theory. The first efficient constructions of good linear codes with these extra properties were given by Forney [For66] and Justesen [Jus72]. By now we have many alternative ways of constructing a variety of explicit, efficient codes (see e.g. the textbook [Rot06, GRS16]). To see that this setting conforms to our notation, note that a 2 subspace of dimension n/10 can be described by a basis, so requires O(n ) bits, the universe Un is the collection of all of these, and the property Sn ⊆ Un are all subspaces with distance n/10, namely all good linear codes. Weak tournaments. This example too has a happy ending. Notation-wise, a fully directed graph on n vertices can 2 be described in O(n ) bits, Un the set of all these tournaments, and Sn the tournaments which 1 are w-weak, for w = 3 log n. An explicit pseudo-random object in this setting, which we will call the Paley tournament, was suggested by Graham and Spencer [GS71], based on a construction of Paley [Pal33]. Its description is extremely simple. Assume for simplicity that n = p is a prime, with p ≡ 3 mod 4, and let the vertices be the elements of Fp. Recall that χ(k) denotes the quadratic ∗ character function on Fp, which is 1 if k is a square in the field and −1 if not. Now for any pair of vertices i, j, direct the edge between them from i to j iff χ(i − j) = 1 (this is a well-defined tournament for such primes as χ(k) = −χ(−k). All computations involved here are easy and so the Paley tournament can be constructed in polynomial time. While the construction is simple, the analysis uses a deep result: Weil’s estimate for the number of rational points in curves over finite fields [Wei49]. The form in which it is used, an exponential sum bound, is itself a typical statement of pseudo-randomness, which exhibits the quadratic character χ itself as a pseudo-random object. We will discuss it further in the subsection below on the Riemann Hypothesis. Ramsey graphs. Here the journey towards good explicit constructions has taken over 70 years. Let us summarize

103 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

2 what is known. First, as before, n-vertex graphs have an O(n ) bit representations, and Un is the set of them all. We defined Sn to be the property of being (3 log n)-Ramsey. Exhibiting one such graph remains an elusive problem. It is thus natural to seek pseudo-random objects with weaker parameters, namely r-Ramsey graphs for larger values of r (one can of course formally r define properties Sn for being r-Ramsey, which are all pseudo-random for r ≥ 3 log n). Even α constructing n -Ramsey graphs for small α > 0 is nontrivial,√ and Frankl and Wilson [FW81] gave a beautiful construction which is r-Ramsey for r = exp( log n). Improvements came from a very different source. The theory of randomness extractors, a central type of pseudo-random object we discuss in Section9, has generated a sequence of very different (and less elegant) explicit constructions [BKS+05,BRSW12,Coh15,CZ15]... with significantly better parameters; the current best ones yielding r = exp(log log n)O(1), quite close (and going down) towards the optimal bound.

8.3 The Riemann Hypothesis The Riemann Hypothesis, perhaps the most famous open problem in mathematics, is non-trivial to formally state. The usual formulation involves the zeta function, a complex object which requires some advanced and specific knowledge. Here we present another (known) formulation, in the language of pseudo-randomness, which is elementary and appealing to state and explain even to high-schoolers. First, let us discuss the drunkard’s walk (more formally known as the random walk on the integers). Assume you have a pub at 0, and, after having a few beers, a drunkard starts walking randomly up and down the street. More precisely, when occupying an integer i, the drunkard moves 1 1 1 to i + 1 with probability 3 , to i − 1 with probability 3 , and stays at i with probability 3 . How far from the pub is he likely to be after n steps? This can be formulated as estimating the sum of a sequence of n independent, unbiased√ random {−1, 0, 1} variables. It is a standard calculation to prove that he will be within O( n) distance of the pub with high probability. n This suggests a pseudo-random property. The universe is Un = {−1, 0, 1} , all possible n-walks. Define a walk z ∈ U to be d-homebound if it ends up within d of the pub, namely | P z | ≤ d. As n √i i mentioned, being d = d(n)-homebound is a pseudo-random property for any d(n) ≥ c n. Can we find an explicit sequence with this property? Sure we can, there are many easy ones, like the all 0’s sequence, or any sequence with an equal number of 1’s and −1’s. The interesting question to ask here is whether any natural mathematical sequences possess that “square-root” cancellation, so typical of random sequences. Here is one famous natural sequence. Definition 8.2 (Möbiussequence). Define (the infinite) Möbiussequence µ = µ(k) for every natural number k as follows. µ(k) is 0 if k has a square divisor. Otherwise it is −1 or 1 depending on whether k has an odd or even number of prime divisors, respectively. Define µn to be the first n symbols of µ.

If our drunkard marched according√ to the instructions of the M¨obiussequence, would it always stay d-homebound for d around n? This simple question about this simply deﬁned sequence is equivalent to the Riemann Hypothesis. More precisely, Mertens [Mer97] proved Theorem 8.3 [Mer97] The Riemann Hypothesis is true if and only if, for every δ > 0, the sequence 1 +δ µn is n 2 -homebound. Of course, the Riemann hypothesis is not known to hold. So, it is natural to weaken the pseudo- randomness demand (as we did for Ramsey graphs), and e.g. ask for any nontrivial cancellations. Namely, is µn at least o(n)-homebound? This innocent question turns out to also be equivalent to

104 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

a well known statement, which in this case is a theorem rather than a conjecture. Namely, it is equivalent to the celebrated Prime Number theorem of Hadamard and de la Vall´e-Poussin, which determines the asymptotics of the number of primes below an integer x to be x/ ln x. So we have

Theorem 8.4 (Prime Number Theorem). The sequence µn is o(n)-homebound. How close is the Möbiussequence to a sequence of coin tosses? Well, it is of course deterministic and hence completely predictable. Its symbols can be successively computed by a Turing machine. Equivalently, the Möbiussequence correlates perfectly with a sequence produced by some deterministic Turing machine. It now makes sense, as is done in the section of computational pseudo-randomness, to subject it to a smaller class of tests than all computable sequences. Let us start from the bottom. The Prime Number Theorem above can be interpreted to saying that the Möbiussequence has vanishing correlation with the absolutely simplest deterministic sequence, the constant sequence 1, 1, 1,... . How about the alternating sequence 1, −1, 1, −1, 1 ... ? How about a sequence produced by a finite automaton, or a real-time Turing machine104? A bold conjecture of Sarnak is that the Möbiusfunction has vanishing correlation with every sequence which is generated by a dynamical system of zero entropy rate105. Some very general cases of this conjecture were proved (see Bourgain, Sarnak and Ziegler [BSZ12] for precise definitions and historical survey). While square root cancellation for the Möbiussequence remains a major question of Mathe- matics, such cancellation was proved for other important sequences in other major theorems. Let’s give an example of this with the theorem we needed for the “weak tournaments” example. A consequence of Weil’s theorem [Wei49] is the following exponential sum bound, for the quadratic character χ. Theorem 8.5 [Wei49] For every prime p, every degree d > 0 and every non-square polynomial f ∈ Fp[x] of degree d,

X √ χ(f(x)) ≤ d p.

x∈Fp Thus, to all these low-degree polynomial “tests”, the quadratic character looks as random as a sequence of coin tosses, at least from the viewpoint of home-boundedness. Similar results hold for other characters. More importantly, a multivariate polynomial generalization of this theorem follows from Deligne’s celebrated “Riemann hypothesis for varieties over ﬁnite ﬁelds” [Del74,Del80]. Exponential sums and related estimates pervade number theory, analysis and ergodic theory, and may also be viewed from this pseudo-randomness angle. While it is not clear if this angle is powerful enough to prove new such results, this connection was extremely fruitful for a variety of applications. Just for illustration, the same theorem 8.5 was used in e.g. [AGHP92] for de- randomization, in [BGW99] for lower bounds, and as we saw above in [GS71] for weak tournament constructions. Some pseudo-random objects (like the quadratic character) have surprisingly wide applicability, and we shall see a much stronger demonstration of this with expanders and extractors.

8.4 P vs. NP How can the P vs. NP question be about pseudo-randomness? The short of it is the following: Almost all functions are hard to compute; is SAT hard to compute? This ﬁts our general framework

104Such a machine must output a symbol at every computation step. 105This is a considerably stronger model than a deterministic real-time Turing machine—it may be viewed as a probabilistic real-time Turing machine with access to o(n) random coins before it outputs the nth symbol.

105 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

in perfect analogy with the previous one of the Riemann Hypothesis: Almost all sequences are homebound; is the Möbiussequence home-bound? Elaborating on this analogy, replace the universe of sequences by that of Boolean functions, replace the pseudo-random property of home-boundedness by the pseudo-random property of computational difficulty, replace the Möbiussequence by the SAT function, and you have replaced the Riemann Hypothesis with the P vs. NP problem as a pseudo-randomness question. We hope that by now the reader can apply this analogy to other settings: all you need are the three ingredients, the universe U, a pseudo-random (= large) property S ⊂ U, and an element x ∈ U whose membership in S (namely its pseudo-randomness with respect to that property S) is in question. Repeating ourselves, this setting, clearly or in disguise, captures many diverse mathematical and computer science problems. Let us return to P vs. NP, and be a bit more formal, as making this example suit our pseudo- randomness framework requires a particular way of setting the parameters. As we shall see, this viewpoint on P vs. NP will also explain the importance of pseudo-randomness to the “natural proof” barrier to lower bounds we met in Section 5.2.4. To be consistent with our notation in this section, it will be useful to name here the input size of a Boolean function by k, so we consider functions f : {0, 1}k → {0, 1}. It will also be convenient to define another complexity class, EXP, of all functions f = {fk} computable in exp(k) time. Our universe Un will be all Boolean functions whose truth table takes n bits; these are Boolean functions f : {0, 1}k → {0, 1} with n = 2k. Observe that the truth table of SAT , or for that matter any function in EXP, can be produced in exp(k) = poly(n) time. Now, according to k/3 1/3 Theorem 5.6, almost all functions in Un require circuit size at least 2 = n . So, the property of a k-bit function f, requiring circuit-size at least h for any h(n) ≤ n1/3 is pseudo-random. Call this property being h-hard. By definition, if SAT , or any problem in NP, is h-hard for even any h(n) (log n)O(1) = poly(k), it would immediately imply that N P 6⊆ P/poly, resolving the most important open problem in this book! Short of proving it for SAT or another explicit function, an easier task is to efficiently generate such pseudo-random h-hard functions. This too is an important challenge of complexity theory, for the following reason. Observe that if we have a poly(n)-time algorithm for generating (given n) the truth table of such an h-hard function f, means that f ∈ EX P. Thus, such algorithm, for h(n) (log n)O(1) = poly(k), would imply the following, much weaker, however very important conjecture. Conjecture 8.6. EX P 6⊆ P/poly. Summarizing, pseudo-randomness can naturally capture proving conjectured circuit size lower bounds. Curiously, the same pseudo-randomness notion can also explain our difficulty in proving circuit lower bounds, e.g. resolving the conjecture above. As mentioned in section 5.2.4, if factoring k-bit integers requires circuit size exp(k) then the conjecture above has no natural proof. We are in a position to better explain this surprising result of Razborov and Rudich [RR97] from Chapter 5.2.4, now that we have developed the appropriate language of pseudo-randomness. Let us try to see what pseudo-randomness has to do with the difficulty of proving computational hardness. Natural proofs (of circuit lower bounds) certify computational hardness of Boolean functions, and by its definition do so for almost all of them. In other words, having a natural proof is a pseudo- random property. But the assumed hardness of factoring enables, by an important result (discussed above after Theorem 7.13) of Goldreich, Goldwasser and Micali [GGM86], the construction of efficiently computable pseudo-random functions. Such functions, by definition “look like” random functions, and in particular satisfy this pseudo-random property. However, by construction these functions are in fact easy to compute! This contradiction is at the heart of the challenge and

106 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

difficulty of proving circuit lower bounds, even beyond the specific notion of natural proofs. The lower-bound prover, implicitly or explicitly, has to figure out a “measure” (or criterion) which will distinguish hard random functions from easy pseudo-random ones, despite the fact that in a very strong sense, the two collections seem “indistinguishable”. The Razborov-Rudich notion of natural proofs is one family of measures (or criteria) which are useless for such lower bound provers (at least assuming that integer factoring is hard, or more generally if any one-way function exists).

8.5 Computational pseudo-randomness and de-randomization In this section we will see that our “abstract” pseudo-randomness framework of this chapter is general enough to capture the “concrete” computational pseudo-randomness discussed in Section 7.2 (which you may want to recall). So we can add to the impressive list of major open problems captured by this framework also the BPP = P? problem. After all, the quest to “find hay in a haystack” efficiently is precisely the problem of de-randomization. Still, it will be useful to spell out more precisely some of the challenges and results of computational pseudo-randomness in this general framework. First, consider the de-randomization of specific probabilistic algorithms. Let A(x, y) be a deterministic algorithm which on every input x, on random input y causes A to output the correct answer (for some fixed function on inputs x) with high probability. We would like to find a deterministic algorithm for the same problem. Putting this task into our general framework is simple. We have a universe Ux for every input x, of all possible random sequences y. For each we have a pseudo-random property Sx ⊆ Ux of all sequences y leading the algorithm to give the correct output on input x. By the fact that the algorithm A succeeds with high probability, Sx contains most elements of Ux. Efficiently finding, for every given x, such pseudo-random y ∈ Sx will de- randomize the algorithm A. It is important to note that different algorithms for the same problem lead to different “haystacks”, and different notions of pseudo-random “hay” to seek; some of these de-randomization tasks may be easier than others. A great success story of this approach is the deterministic primality test algorithm of Agrawal, Kayal and Saxena [AKS04] from 2002. Indeed, [AKS04] solved this search problem and de- randomized one specific probabilistic primality algorithm, of Agrawal and Biswas [AB03]. It is an important point to make that this probabilistic algorithm was designed with the hope that the search problem above may have a deterministic algorithm (and it did!). The nature of the haystack arising from this algorithm is too complex to describe here (we give more details in Sec- tion 13.1). But primality tests provide another, simpler haystack, which is simpler to describe, and de-randomize, under a number-theoretic assumption. Indeed, the story begins with the deterministic algorithm, which was replaced by a randomized one to eliminate the assumption. In 1976 Miller [Mil76] gave an efficient deterministic primality test assuming the Extended Riemann Hy- pothesis (ERH). Miller’s algorithm may be viewed as a de-randomization of the (later) probabilistic primality test of Rabin [Rab80]. Rabin actually designed it to eliminate the ERH assumption underlying Miller’s algorithm106. The search problem for Rabin’s algorithm is much easier to describe (and we will cheat to describe one even simpler). Let x be an integer. The haystack Ux may be viewed as all numbers modulo x. A number y in this set is good (hay), namely in Sx, if it has Jacobi symbol −1. At least half of the y’s are good, namely will lead to a correct output for Miller’s algorithm. What Miller observed, using a number theoretic result of Ankeny [Ank52], is that there

106Solovay and Strassen [SS77] designed a somewhat diﬀerent probabilistic primality test earlier, independently of Miller and Rabin.

107 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

must be a good y among the first n2 integers, where n is the binary length of x. Thus, a simple search through all small integers solves the search problem (finds hay) in deterministic polynomial time (assuming ERH of course). In other words, the set Y of the first n2 integers is (when considered modulo x) is a perfect sample, in that it will contain a good y for every Ux with n-bit input x. Next, we will cast in our general framework the de-randomization result for BPP of Section 7.2 (which does require hardness assumptions!), that we summarize here. The goal is to simultaneously fool every efficient probabilistic algorithm A on every possible input x. To do so, we design an efficient pseudo-random generator, which for our purposes here is captured by its image: a polynomially small collection Y of n-bit sequences (say Y = {y1, y2, . . . , yt} with t ≤ poly(n)), which is a “nearly perfect sample set”. Namely, the uniform distribution on this sample Y is computationally pseudo-random: it looks like the uniform distribution on all sequences, to every small circuit107. The de-randomization procedure for any algorithm A and input x will simply take a majority vote of A(x, yi) over yi ∈ Y . The pseudo-random property of Y is guarantees that most of its elements cause A to output the correct answer, and so the majority vote will always be correct. Let us spell out the ingredients of this approach to the BPP = P? question more precisely with concrete parameters in our general framework. Let t = n4.

n • The universe Un is the set of all t-subsets of {0, 1} .

• The (pseudo-random) subset Sn contains all Y ∈ Un such that the uniform distribution on Y is pseudo-random108109 .

• The set Sn contains almost every Y in Un, and so is indeed pseudo-random. This can be established by a standard counting argument.

• The related search problem is: given n, find an element of Sn. • If the search problem has a poly(n) time algorithm, then BPP = P. The gist of the general de-randomization results of Chapter 7.2 is the design of such an efficient algorithm for this search problem, assuming a hard enough function exists! The pseudo-random set Y constructed by this algorithm is the image of an efficient pseudo-random generator based on such a hard function. Is it possible to get such a general de-randomization results unconditionally? For polynomial time circuits, efficient pseudo-random generators imply circuit lower bounds which we cannot currently prove (in the terminology of this section, the set of tests is simply too powerful). So here hardness assumptions are necessary for pseudo-randomness. But following this paradigm has led complexity theorists to consider a large variety of interesting computational models which are weaker than polynomial size circuits. These models compute fewer functions, so this battery of tests is smaller, which makes the pseudo-random property larger, and the potential to find a pseudo-random object easier. This idea has been extremely fruitful, and led to unconditional pseudo-random generators for a wide variety of important classes, including memory bounded algorithms, constant-depth circuits, low-degree polynomials and more. We conclude with one celebrated example of such work, which will be discussed again in Chap- ter 14. Consider probabilistic algorithms which use little memory—logarithmic in the input length.

107These circuits capture the computation of all eﬃcient algorithms A on all inputs x of a given length. 108In the sense of Chapter 7.2 with respect to all n3-size circuits. 109Every such set Y is a nearly-perfect sample set for every algorithm A running in time n2 using n random bits.

108 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

A relevant example is an algorithm that performs a random walk on a graph; it needs only remember at every stage the name of the vertex it currently occupies, whose binary length is logarithmic in the size of the entire graph. Now let us consider to what kind of “tests” such algorithms can subject their random input. One type of computation that is easily performed by limited-memory algorithms is counting. Therefore, they can perform many standard “statistical tests” appearing in statistics textbooks and used in numerous scientific experiments. Typical such tests count various small patterns in the sequence and check that they are distributed roughly as in a random sequence. The design of (nearly-perfect) sample sets, even for specific statistical tests, occupied the field of experimental design in statistics. If we aim to fool all limited-memory algorithms, we in particular ask if one can fool all these tests simultaneously, and unconditionally? Remarkably, a definite positive answer was provided in the seminal work by Nisan [Nis92], who devised a beautiful low-memory pseudo-random generator against all such algorithms. This generator uses slightly super-polynomial time (a more precise statement appears in Chapter 14 on space complexity). While explaining these important results is beyond the scope of this text, we note that also here there is a source of hardness which implies pseudo-randomness, once it is encapsulated properly. Nisan’s insight110 is that a good way to encapsulate pseudo-randomness tests performed by small memory algorithms is by low communication 2-party protocols (so the primary resource, communication, is actually information theoretic rather than computational). More precisely, one needs to establish that computing (or even approximating) certain functions on two arguments h(x, y) requires a lot of communication between two parties, one of which is holding x and the other y. While this is easy to prove, converting it into a pseudo-random generator requires more ideas and work! This viewpoint of Nisan’s generator is explained and expanded in [INW94]. The field studying the kind of lower bounds above is called communication complexity, discussed in Chapter 15.

8.6 Quasi-random graphs In this section and the next one we study graphs. This section will focus on “dense” graphs (with quadratically many edges) and the next on “sparse graphs” (with linearly many edges). The theory of quasi-random graphs originated in the papers of Thomasson [Tho87] (who actually called them “pseudo-random graphs”) and Chung, Graham and Wilson [CGW89] (whose terminology of “quasi-random graphs” stuck). It is one of the earliest examples of a comprehensive study of pseudo-random properties in the sense we discussed here, and illuminates a few points we did not address yet, specifically reductions and completeness for such properties. The study of random graphs and their properties was initiated in the seminal papers of Erd˝os and Rényi in [ER59, ER60] and became a huge field of inquiry. Recall that a random graph on n 1 vertices is defined by letting every pair of vertices have an edge between with probability 2 . In other words, it is the uniform distribution on the set, that we naturally name Un, of all undirected graphs on n vertices111. Consider several different properties, all of which are quite easy to prove are pseudo-random, namely hold for almost all graphs G ∈ Un. Note that the first three address seemingly different aspects of a graph G; the first counts the number of edges in large subsets of G, the second counts the occurrences of small “pattern” graphs in G, and the third computes an algebraic property—the top eigenvalues of G’s adjacency matrix. In all, these parameters are required to be close to their expectation in a random graph, asymptotically as n grows.

110Which he says was sparked by a homework problem in a complexity class of Umesh Vazirani he took at Berkeley. 111 To be fully consistent we could have named this set Un, as the bits describing this distribution are the edges 2 of the graph, but we expect no confusion to arise.

109 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

2 2 S1 : For every subset of vertices T ⊂ [n], the number of edges within T is |T | /4 ± o(n ).

v −(v) S2 : For every ﬁxed labeled graph H, the number of copies of H in G is (1 ± o(1))n 2 2 , where v is the number of vertices in H.

S3 : The top two eigenvalues of the adjacency matrix of G satisfy λ1 = (1±o(1))n/2 and λ2 = o(n). 2 4 S4 : The number of edges in G is (1±o(1))n /4, and the number of 4-cycles in G is (1±o(1))n /16. Chung, Grham and Wilson’s paper [CGW89] proves the following remarkable statement: all four properties are equivalent. Theorem 8.7 [CGW89] If a (large enough) graph satisfies any one of these properties, it satisfies them all. Thus, any graph satisfying one of these properties, satisfies them all (as well as others studied in that paper). This suggests some notion of completeness for pseudo-randomness, which is indeed brought out most powerfully by the last property S4. Note that S4 tests only two parameters of the graph, whereas S2 tests these as well as an unbounded number of others. While it is obvious that a graph satisfying S2 also satisfies S4, the surprising fact is that the converse holds as well. So, the statistics of edge and 4-cycle occurrences in a given large graph dictates (up to negligible error terms) the statistics of every finite subgraph! The paper [CGW89] also studies which specific graphs are pseudo-random in the sense above. The reader might not be stunned to find out that one answer is the canonical example, the Paley graph. This is actually a variant of the Paley tournament we saw earlier, in which the number of vertices is a prime n = p but this time with p ≡ 1 mod 4, with an edge between i and j iff χ(i − j) = 1 (which is well defined since for such p we have χ(k) = χ(−k)). To prove its pseudo- randomness it suffices to do so for the simplest property, which is S4. And√ this property holds (using Weil’s theorem 8.5 again), since every pair of vertices has n/4 ± O( n) common neighbors, from which the counts follow. Of course, one can study other classes of random graphs under different distributions, and their properties. Interestingly, one can also go in the reverse direction; start from the (would be) pseudo-random properties and develop classes of random graphs (or other objects) from them. An important case in point, which developed into an important theory is the following. Take any sequence of graphs G = {Gn} for which all statistics in S2 converge in an appropriate natural sense (namely, the graphs Gn share, in the limit, the occurrence frequencies of all finite graphs H). Then this sequence gives rise to a random graph model (called graphon) which greatly generalizes the Erd˝os-Rényi theory, and from which one can sample graphs of any size in a natural way (which we will not describe here). In this model, the property of having these specific subgraph statistics is a pseudo-random property! This emerging theory of Graph Limits is extremely exciting; it connects to algorithms and coding theory through the area of property testing (see Goldreich [Gol10]), to statistical physics through the study of partition functions and Gibbs distributions, and finally it allows doing analysis and using analytic tools (in the classical sense of limits, convergence, com- pactness, etc.) in the combinatorial area of extremal graph theory. The reader is encouraged to find out more (see Lovász’sbook [Lov12]).

8.7 Expanders Expander graphs are perhaps the most universally applicable pseudo-random objects. They play key roles in almost every area of the theory of computation: algorithms, data structures, circuit

110 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

complexity, de-randomization, error-correcting codes, network design and more. In mathematics they touch in fundamental ways different subareas in each of analysis, geometry, topology, algebra, number theory and of course, graph theory. Precious few nontrivial mathematical objects can boast a similar impact. Hoory, Linial and Wigderson’s monograph [HLW06] is quite comprehensive, although lots has happened since it was published. Expanders are sparse graphs. So here we will consider our universe Un to be all d-regular graphs on n vertices (namely, every vertex is touched by d edges), where d is the same fixed constant for all n. Here are some natural pseudo-random properties of these objects. We state them informally. Note again that they seem entirely different, one expressing a combinatorial/geometric property, the second an algebraic property, and the third a probabilistic property, of a d-regular graph.

S1 : For every t and subset of vertices T ⊆ [n] of size |T | = t, the number of edges between T and its complement is roughly dt(n − t)/n.

S2 : All nontrivial eigenvalues of the adjacency matrix of G are bounded away (in absolute value) from the ﬁrst one, which is d.

S3 : The natural random walk on G converges to the uniform distribution in O(log n) steps (at an exponential rate).

It is standard to check that each of these properties hold for almost every d-regular graph. Again here we have the surprising result that all three properties are equivalent: if any graph has one, it has the others (a sure sign that the notion defined is basic)! The equivalences are known with specific quantitative relations between the different unspecified parameters, through a series of works in the 1980s [Tan84, AM85, Alo86, SJ89] (the connection between S1 and S2 is a discrete analog of the important Cheeger inequality for Riemanian manifolds [Che70]). A graph is an expander if it is pseudo-random in this sense. The first to define expanders and prove their existence (via the probabilistic method) was Pinsker [Pin73]. Can one explicitly construct expanders? In the previous section a pseudo-random graph presented itself, the Paley graph. In this sparse setting it is far less obvious. The problem of explicitly constructing expanders has attracted researchers and techniques from many different fields. The first explicit construction is due to Margulis [Mar73], who used the “Kazhdan property (T)”. Today we know of a variety of ways, algebraic and combinatorial, to construct expanders (the main approaches are listed at the end of the section). Precise definitions, different constructions and many applications appear in the monograph [HLW06]. More applications are sketched in the survey talk available here [Wig10]. Let us see one construction, one open problem and one application, which should tempt the reader to find out more about these remarkable objects. Let p be a prime, and consider the 3-regular graph Gp whose vertices are the elements of Fp, and we connect every vertex to its predecessor, successor and inverse. In other words every x is connected by an edge to x − 1, x + 1, and x−1 (as 0 has no inverse we can connect it to itself). Sarnak’s following theorem is from section 3.3 in [Sar90].

Theorem 8.8 [Sar90] The family Gp is a family of expanders. While the graphs themselves are simple to describe, their expansion proof uses very sophisticated tools (as is common in this ﬁeld). It follows from the expansion of the Cayley graphs112 on SL(2, p) with the standard generators, and the fact that the graphs Gp above are Schreier graphs of the action

112The vertices of Cayley graphs are all elements of a given group, and two vertices are connected if their ratio belongs to a given set of generators.

111 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

of these groups on the projective line by the Möbiustransformation. The expansion of SL(2, p) was first derived from Selberg’s famous 3/16-theorem in number theory [Sel65]. A different proof of this expansion, using arithmetic combinatorics, was given by Bourgain and Gamburd [BG08]. Let us observe how explicit these graphs Gp are. If p is an n-bit integer, we can represent the elements of Fp by n-bit sequences. The neighborhood structure is so simple that, given a vertex x, it is possible to compute its 3 neighbors in poly(n)-time. So we have an exponential size graph that has such a succinct description, by the algorithm for neighbors. This level of explicitness113 will be crucial in the application we present, and turns out to be crucial in many others. One can summarize our knowledge of how explicit and efficient are these constructions. The parameters of the graphs chosen here are not the most general, but are convenient and suffice for most applications. Theorem 8.9. For every constant c there is a constant d and a poly(n) time114 algorithm A, such n 115 that for every integer n there is a d-regular graph GN on N = 2 vertices with the following properties.

n • Explicitness: On inputs n and x ∈ {0, 1} , A outputs the d neighbors of x in GN .

• Eigenvalue expansion: All nontrivial eigenvalues of GN are bounded in absolute value by d/2. • Vertex expansion: Every set S ⊆ {0, 1}n of size s ≤ o(N/d) has at least cs neighbors in GN . A note on optimality of parameters will lead us to our open question. For the eigenvalue deﬁnition of expansion, the optimal relationship between c and d is known√ and can be achieved. By the Alon-Boppana theorem [Alo86] (see proof in [Nil91]) c ≥ 2 d − 1 − o(1) and this was achieved by the explicit Ramanujan√ graphs of Lubotzky, Phillips and Sarnak [LPS88], and of Margulis [Mar88] which satisfy d ≥ 2 d − 1. On the other hand, for vertex expansion, random graphs satisfy “lossless expansion”116 c ≥ (1 − o(1))d whereas the best known explicit construction 1 of Kahale [Kah95] achieves “only” c ≥ ( 2 − o(1))d. Explicitly achieving c > d/2 has been open now for 20 years. The best partial result is a construction of bipartite graphs which expand losslessly in one direction [CRVW02]), a property which already suﬃces for applications beyond what eigenvalue expansion achieves. For our application, consider the following problem, which may be called deterministic error reduction. You have a probabilistic algorithm A which you want to run on input x. This requires n random bits, which is exactly what you possess. The problem is that the error guaranteed by the algorithm is, say, 1/10, which is far too high for you. So, you would like to reduce it. We showed in the probabilistic algorithms section that errors can be easily reduced, e.g. to exp(−k) for any k. The idea is to run A on x for k times with independent randomness each time, and then take the majority vote of the answers. However, this requires kn random bits, which you don’t have. Is any reduction of error possible with only the n random bits you have? A beautiful positive answer was given by Karp, Pippenger and Sipser [KPS85], which is one of the earliest applications

113Actually, eﬃciently obtaining large primes p may be diﬃcult, as we mentioned in Section 7.1, and so the description above is not fully explicit. However there are ways around this problem (which we don’t discuss) that result in fully explicit graphs with the same properties. 114Indeed, even logarithmic space. 115We pick a power of two so as to label vertices by binary sequences, but one can pick any other integer. 116They have essentially as many neighbors as possible, as this number cannot exceed sd.

112 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

117 of expanders. Simply, use your random bits to produce a random vertex x in Gp above . Then consider all vertices at distance d = O(log n) from x, where each of them is an n-bit sequence. Use each of them as randomness when running A on x, and as before, compute the majority vote of the answers. Note that the process of finding all these vertices is efficient—simply apply the algorithm d computing neighbors in Gp repeatedly to generate all 3 = poly(n) paths in Gp and take their endpoints. What is less obvious, but follows from the expansion properties of Gp, is that the error of this algorithm will reduce to any n−c (the choice of c determines the constant in the definition of d). Expansion is not only a fundamental and widely applicable notion across mathematics and computer science, but also has remarkably diverse sources. By now we have a surprising wealth of methods to explicitly (and non-explicitly) construct expander graphs, each with its own benefits and consequences. In particular, these methods give a comprehensive, if still incomplete, understanding of the broad challenge set by Lubotzky and Weiss [LW93]: find out which finite groups, with which generating sets, yield expanding Cayley graphs. We say a few words about each, which may inspire the reader to dig deeper. • The “mother group” approach, initiated by Margulis [Mar73]. Here the family of finite expanders are Cayley graphs, with the underlying groups are all quotients of a single infinite group. Here properties of this mother group determine the expansion of the quotients. This approach led to the eigenvalue-optimal Ramanujan expanders of [LPS88, Mar88] mentioned above. • The “bounded generation” approach, initiated by Shalom [Sha99]. It leads (with many other ideas) to Kassabov, Lubotzky and Nikolov’s very general theorem that every118 (non-abelian) finite simple group has a fixed set of generators making the Cayley graph expanding [KLN06]. • The “zig-zag” approach, initiated by Reingold, Vadhan and Wigderson [RVW02]. This combinatorial method iteratively constructs larger and larger expanders from a fixed one. A connection of this combinatorial method to semi-direct product in groups [ALW01] has led to Cayley expanders of some very non-simple groups [MW04, RSW04]. The zig-zag method underlies the construction of lossless bipartite expanders [CRVW02] mentioned above, and also lead to a breakthrough in computational complexity [Rei08] on the space complexity of graph exploration (see more in Chapter 14). • The “arithmetic combinatorics” approach, initiated by Bourgain and Gamburd [BG08]. Here again expanders are Cayley graphs, and expansion follows (among other things) from growth of sets under group product. This general method works to prove expansion in all simple linear groups of finite rank, with almost every pair of generators (as opposed to specially chosen ones in other methods) [BGGT13]. This powerful method also underlies expansion in unitary groups [BG10], the explicit construction of monotone expanders and dimension expanders [BY13] and the affine sieve [BGS10], among other applications.

• The “lifting” approach, initiated by Bilu and Linial [BL06]. Again, this is a combinatorial, iterative method, where larger expanders are generated from smaller ones via lifting. Op- timal analysis via “interlacing polynomials” by Marcus, Spielman and Srivastava [MSS13a]

117Assume here for simplicity that p = 2n (which is of course impossible). The case p 6= 2n can be handled as well with some care. 118The missing Suzuki group was added to complete this list in [BGT10].

113 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

of this constructive lifting method has led to completely new Ramanujan expanders (made constructive in [Coh16]) and other consequences discussed in Section 13.3. We conclude by noting a recent line of work, started by Linial and Meshulam [LM06] and by Gromov [?], which deﬁnes and studies expansion beyond graphs, in higher dimensional simplicial complexes. The quest to explicitly construct these objects beautifully connects algebra, geometry and topology, and has already found connections and applications to such computational areas as property testing and quantum error-correcting codes. An introduction to this rapidly moving ﬁeld is [Lub14].

8.8 Structure vs. Pseudo-randomness This section only exposes a tip of a growing iceberg, in which pseudo-randomness, and its interaction with structure, both defined to suit the occasion, becomes a very powerful “meta proof technique” in a diverse number of math and CS areas. One beautiful survey by Tao [Tao07a] explains in detail how this technique is present in the sequence of works on arithmetic progressions in the integers: Roth’s theorem, Szemerédi’stheorem, Szemerédi’sregularity lemma, Furstenberg’s ergodic theory proof, Gowers’ quantitative bounds, and the Green-Tao theorem about progressions in the primes. Further, it elucidates the need and presence of “structure vs. pseudo-randomness” dichotomy theorems for a variety of mathematical objects. Tao gives many more applications in other areas, including number theory, partial differential equations, ergodic theory and graph theory in these lecture notes [Tao07b, Tao07c, Tao07d]. Yet another computational source of a variety of dichotomy theorems are the attempts (mentioned in Section 8.5) to design pseudo-random generators against weak computational models, some of which we will mention below. Let us start with one general set-up which can be specialized to many of the examples above. Let X be a finite set and we let our universe U be all bounded functions on X, specifically all functions f : X → [−1, 1]. For example, when U is all graphs on n vertices, then X will be the set of all pairs i 6= j ∈ [n], and a graph G is represented by such function f as follows: f(i, j) = 1 if (i, j) is an edge of G, and f(i, j) = −1 otherwise. Note that allowing range [−1, 1] actually allows to also consider “edge-weighted graphs”, or equivalently convex combinations of graphs. For any two functions f, g ∈ U, we define their correlation simply as hf, gi = Ex∈X [f(x)g(x)] when the underlying distribution on X is uniform. We will use correlation to define pseudo- randomness. A pseudo-random property will be defined by a family of “test” functions F in U as follows. Pseudo-random functions will be those which are “almost orthogonal” to every test function in F. More precisely, call a function g ∈ U (, F)-pseudo-random if for every f ∈ F, |hf, gi| ≤ . This mechanism of defining pseudo-randomness is very general. Indeed, most of the pseudo-random properties listed in previous subsections can be expressed in this way. For example, property S1 of expanders above is obtained by taking, for every subset T of vertices, the indicator function on the pairs of vertices between T and its complement, and subtracting from it the expected value for a set of that size in a random graph. Thus, in this example, every set T yields a test function. Let us give a template of one basic type of desired (and often obtained) dichotomy theorem between structure (or “simplicity”) and pseudo-randomness. Theorem 8.10 (Template dichotomy theorem). Let U and F be as above. Then every function g ∈ U can be decomposed as g = s + e

114 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

where s is a “simple” function, and e (for “error”) is a pseudo-random function, both with respect to F. More precisely, there is a real function m such that for every > 0, there is such decomposition with the following properties. First, the function e will be (, F)-pseudo-random. Second, the function s is composed from at most a finite number m(), depending only on , of functions from F. Namely s = h(f1, f2, . . . , fm) with m ≤ m(), fi ∈ F and h is some (combining) function. Let us see how such a dichotomy theorem may be useful for proving statements about all objects in U. Basically, it allows us to treat separately simple objects and pseudo-random ones (which are simple in a different, “statistical” sense). This sounds naive, and indeed we describe it in a naive, high level fashion, but it should give a sense of the way some powerful theorems above are proved. So, suppose you want to prove some universal statement about U, namely that every object in it has some desired property. For example, you may be interested in proving Szemerédi’stheorem: that for every fixed δ > 0, and every integer k, every subset of the first n integers (for large enough n in terms of δ, k) of measure δ must contain a k-term arithmetic progression. In this example Un is the family of all δ-dense subsets of [n]. The first step is to understand why a random object from U satisfies the desired property. Finding sufficient conditions for this119 may suggest pseudo-randomness “test functions” F, which in turn suggest, by the dichotomy theorem, what is simple “structure”. In the arithmetic progressions example, it is easy to see that a random subset of [n] of measure δ will have in expectation plenty of k-term progressions, roughly δkn2. So, a chosen pseudo-random property can naturally try to enforce these statistics. Roth’s theorem [Rot53] on 3-term arithmetic progressions in dense subsets of integers, which inspired this whole development, is doing just that. Roth observes that the statistics of such progressions holds if the subset has small correlation with any periodic function, and so he takes the characters of Zn to be his family of pseudo-randomness tests. For larger k, Gowers [Gow01] invented his Gowers norms, pseudo-randomness tests that similarly enforce the statistics of k-term progressions in random subsets. Of course, the hard part is making the right choices of pseudo-random test functions, to balance between the structured and random-looking parts, in a way that allows proving that each (and their sum) have the desired property. Let us return to the dichotomy theorems themselves, and try to understand when we can prove such theorems. First, let us spell out a very basic one, indeed using linear characters. It is extremely simple and can be thought of as a college math homework about discrete Fourier transforms. Let n ˆ n X = F2 , and U the set of all functions on X. The dual group X has 2 characters, χT , one for every subset T of [n]. We will take this collection to be our set of test functions, namely F = Xˆ. Giving a structure vs. pseudo-randomness theorem as above in this setting is easy. Recall that the functions n in F form an orthonormal basis for R2 . Thus, every function g ∈ U has a unique representation P in this basis as g = T cT χT , where the coefficients cT are called the Fourier coefficients of g, and are computed by cT = hχT , gi. Now the decomposition suggests itself. Given > 0, call T P large if |cT | ≥ and small otherwise, and define the simple part to be s = cT χT and the P T large pseudo-random part e = T small cT χT . Clearly, g = s + e. The function e is (, F) pseudo-random by definition of small and the orthogonality of characters. The simplicity of s is argued as follows. P 2 The norm hg, gi of g is 1, and so Parseval’s identity implies that T large(cT ) ≤ 1. As each |cT | is at least , there can be no more of m() = −2 functions in the simple part. Note that the combining function h in s here is extremely simple and efficient, namely a linear combination.

119Which is very similar to attempts of de-randomizing particular probabilistic algorithms, where we seek suﬃcient conditions on properties of the random input which will cause the algorithm to give the correct answer.

115 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

It should be clear that there was nothing special about the Fourier characters above—all we used was the orthogonality of the functions in F. In other words, the template dichotomy theorem holds when F is an orthonormal basis of U. This seems, and indeed is, an extremely simple case. In what generality can we expect such a dichotomy theorem to hold? Well, in full generality! Remarkably, every choice of X and F afford such a decomposition! Many special cases of it appeared, including in Szemerédi’sregularity lemma, the Green-Tao work on arithmetic progressions in the primes, and in general (but in different form) in [TZ08, RTTV08]. The following version, which gives the best parameters, is due to Trevisan, Tulsiani and Vadhan [TTV09]. Theorem 8.11 [TTV09] The template dichotomy theorem holds for every choice of X and F. Moreover, the bound m() = O(−2), and the combining function h uses at most −2 simple operations: addition, multiplication, and threshold. The proof is essentially greedy, and goes roughly as follows. One constructs the (simple) function s approximating the given g in stages, starting from the constant zero function. If the current g − s has correlation below with all functions in F, we are done. If not, and g − s does have correlation at least with some member f ∈ F, then we add to s (an appropriate) constant multiple of f. Finally, a simple potential function is used to bound the number of iterations. This powerful idea and its variants has found uses (often under the names “boosting” or “multiplicative-weight updates”) beyond pseudo-randomness in numerous algorithmic and other application areas. We discuss two such (related) applications later in the book, for on-line predictions in Chapter 16 and for amplifying the quality of learning algorithms in Chapter 17. An excellent survey on this meta-algorithm is [AHK12]. Let us demonstrate one (indirect) application of this dichotomy theorem to computational pseudo-randomness. Every Boolean function can be “approximated” by an easily computable one, in the sense that their symmetric difference is computationally pseudo-random. Corollary 8.12. Let U to be the set of all Boolean functions on n bits. Also, for some fixed c, let = n−c and let F be the set of all nc-size circuits on n input bits. For every Boolean function g we have g = s ⊕ e, where s ∈ P/poly and e is computationally pseudo-random—no function in F has correlation ≥ with e. Special cases of this general dichotomy theorem, proved in a similar fashion earlier, were actually motivating sources for it, which arose while studying a variety of objects with different motivations, including the “weak regularity lemma” of Frieze and Kannan [FK96] in graph theory, the “dense model theorem” of Tao and Ziegler [TZ08] used for progressions in primes, and the “hard-core set” theorem of Impagliazzo [Imp95a] from computational pseudo-randomness. Trevisan, Tulsiani and Vadhan’s paper [TTV09] gives three quite different proofs representing different origins; one using the “boosting” technique from computational learning theory, one using the minimax theorem from game theory, and one using the recursive refinement arguments àla Szemerédi. As mentioned, there is a great variety of dichotomy (or “decomposition”) theorems between randomness and structure, in other settings, which may differ in form but have the same essence. We list some of the recent mathematical objects for which such results were proved. Some are quite a bit more complex than the template above, but in some cases, like the first item below, the situation is even simpler, in that every object itself is either “structured” or “pseudo-random”.

• Bounded degree polynomials over ﬁnite ﬁelds [GT09, KL08]. • Bounded degree polynomials in Gaussian variables [Kan12, DS13].

116 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• Bounded sensitivity Boolean functions [Hat10]. • Bounded degree polynomial threshold functions [DSTW14]. • Hypergraphs [RS06]. • Inverse theorem for the Gowers’ norms [GTZ12, Sze12].

117 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

9 Weak random sources and randomness extractors

Probabilistic algorithms, and many other applications of randomness, are analyzed assuming access to an unlimited supply of independent, unbiased bits. Does reality provide such perfect randomness? Suppose nature is deterministic, and perfect randomness is simply non-existent. Even then, Section 7.2 demonstrated that believable hardness assumptions imply BPP = P (namely every probabilistic algorithm can be efficiently de-randomized), and so all these algorithmic applications of perfect randomness survive in a deterministic world. But suppose that we want unconditional results. What are the minimal assumptions about nature which will afford the same algorithmic applications? A reasonable middle ground regarding nature, which seems to be supported by experience, is that even if it does not provide us with perfect random bits, many of its processes are, to some extent, unpredictable. This includes the weather, stock-market, Internet traffic, sun-spots, radioactive decay, quantum effects and a host of others, which we can tap into for randomness; indeed, in practice, many computer systems generate the random bits needed for a variety of algorithms in precisely this way. Sampling such processes generates a stream of possibly correlated, biased random bits120. This leads to obvious questions. What is a good mathematical model for such weak randomness? Can we use it for applications requiring perfect randomness? How? Three decades of study have generated a beautiful theory, answering these questions and others. These developments are surveyed in detail in [Nis96, Sha04, Vad11], and we will briefly summarize them below. First we describe a formal mathematical model of weak random sources. Then, we describe the hero of this section, the randomness extractor, a deterministic algorithm whose role is to “purify” a random sample from any weak random source into a perfect (or near perfect) sample from a uniform distribution (which in turn is usable in applications). As it happens, randomness extractors, born for the purpose above, turned out to be useful, even essential, in a variety of diverse application areas, including error-correcting codes, data structures, algorithms, de-randomization, cryptography and more. Interestingly, in many of these applications, randomness is completely absent—it is rather the pseudo-random properties of extractors which make them so applicable, much like the case with expander graphs of the previous section. For all of these applications we need efficiently computable extractors, and we will describe explicit constructions of such efficient extractors. We note that the extractors we discuss here are sometimes called seeded extractors, to distinguish them from a more restricted cousin, deterministic extractors. The latter deals only with restricted families of sources, as does another related area of research—data compression [ZL78]. Here we survey only work on the most general class of weak random sources, which have some entropy but otherwise have no structural restrictions. To get a feel of what weak sources may look like, and the challenge of purification, here are a few examples. For warm up, how would you purify a sequence of independent tosses of the same biased coin, without knowing the bias, except that it is in the range, say [0.1, 0.9]. Specifically, find a deterministic algorithm that converts an n-bit sequence from such a source into another (possibly shorter) sequence that is uniformly distributed (try it, or peek at this footnote121). Here are some other examples of “weak” sources. First, a sequence of independent coin tosses as above, but when each toss has a possibly different unknown bias in this range. Next, a sequence generated one bit

120Note that even though quantum mechanics predicts the measurements of (say) successive photon spins yield perfectly random bits, the physical devices generating and measuring these will not be perfect. 121The idea, going back to von Neumann, is simple. Pair up the bits of the input sequence and consider them left to right. Ignore the pairs 00 and 11. For each pair 01 output (say) Head and for each 10 output Tails. Note that 1 each output symbol is independent of the others and has probability 2 .

118 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

at a time by an adversary, who, depending on past toss outcomes, picks a bias from this range, and tosses the next coin with this bias. Finally, a sequence of n bits in which an adversary tosses independent, unbiased coins in (say) n/10 bit positions of his choice, and then uses the outcomes to determine the values in the remaining bit positions deterministically. Note that while such distributions may indeed arise from sampling “weak” natural sources, they can also arise in practical computing scenarios. For example, if you pick a completely random n-bit key key for cryptographic purposes, but parts of it leak to an adversary (possibly a small bias of each bit, or perhaps the values of an unknown subset of n/10 of them), the conditional distribution on your key is of the types above! A completely different scenario leading to similar distributions arise in construction of pseudo-random generators for space-bounded computation (discussed in Chapter 14). These situations illustrate why the use of randomness extractors exceeded their initial motivation as mentioned above. What does it mean to extract pure randomness from such weak sources? The chosen purification method should work for every distribution in the class—we used the word adversary to stress that the distribution is picked after the purification method was chosen. Note that all the above examples of probability distributions have entropy122 which is very substantial: a constant fraction of the length n. However it is far from clear how to use this fact, as the purifier doesn’t know where this entropy is “hiding”. It is important to stress that the purifier gets only a single n-bit sample from the unknown distribution—neither nature nor adversaries would do us the favor of providing several independent samples from it.

9.1 Min-entropy and randomness extractors

Min-entropy: formalizing weak random sources John von Neumann was probably the first to ask the question, in the 1940s, of how to use an imperfect random source. von Neumann actually needed perfect random bits for Monte Carlo simulations on his “IAS machine” (one of the earliest computers). We explained his solution for the warm-up example above. In the 1980s, starting with Blum [Blu86], came a sequence of different models of weak random sources (like the examples above and others). A complexity-theoretical motivation for studying weak sources was given by Sipser [Sip88]. Finally, Zuckerman [Zuc90] gave the ultimate definition of distributions we may hope to purify; a weak random source is simply modeled as an arbitrary probability distribution, on {0, 1}n, which has some amount k of entropy in it. It turns out that the right notion of entropy to take is min-entropy defined below, as opposed 123 to the classical Shannon entropy . Min-entropy is simply the logarithm of the L∞ norm of the probability distribution124.

n Definition 9.1 (Min-entropy). Let D be a probability distribution on {0, 1} , and let Dx denote n the probability of a sequence x ∈ {0, 1} . The min-entropy of D, denoted H∞(D) is the maximum, n over all x ∈ {0, 1} , of − log2 Dx. 122For now the reader can think about “entropy” informally as “randomness contents” or formally as Shannon’s entropy. We will soon define the notion of entropy that is actually relevant to this setting. 123The reason for this choice is that there are distributions with extremely high Shannon entropy in which a single sequence has high probability, and this makes randomness extraction impossible. 124This notion appeared first in this context of randomness extraction (but to define a more restricted class of sources) in [CG88].

119 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Definition 9.2 (k-source). We say that D is a k-source if H∞(D) ≥ k, namely if every sequence x occurs in D with probability at most 2−k. It is instructive to convince yourself that all four examples of weak sources above are k-sources for k = Ω(n). A convenient way to think about a k-source D, which turns out to lose no generality in the sequel, is simply as the uniform distribution over some (unknown!) subset S ⊂ {0, 1}n, of size at least 2k. Of course, we continue to think asymptotically, so while discussing fixed n and k we really consider√ ensembles of distributions D = Dn, and allow the min-entropy k = k(n) to depend on n, e.g. be n. Moreover, the purification algorithm will have to be efficient in terms of n.

Randomness extractors: formalizing purification of randomness The purification algorithm is called a randomness extractor, or briefly extractor. Let us try a naive formulation of it, observe its flaw, and then fix it to the correct definition. As extractors must be deterministic, it is natural to consider a function f : {0, 1}n → {0, 1}r an (n, k)-extractor if for every k-source D on n bits, f(D) is statistically close to Ur, the uniform distribution on r bits. In other words we have the L1 distance |f(D) − Ur|1 is at most , which for this section is best taken to be = 1/poly(n) (even though for some applications a small constant suffices). Clearly, we must have r ≤ k, as a deterministic process cannot increase entropy125. Unfortu- nately, such functions f as above simply do not exist. They fail to exist even in the extreme case where k = n − 1, namely the entropy is almost everything, and on the other hand we are trying to extract only one bit, namely r = 1. The reason is that for the Boolean function f, at least one of f −1(0) or f −1(1) has size at most 2n−1. So, let D be the uniform distribution on the larger set of the two, and note it has min-entropy at least n − 1. On the other hand, the distribution f(D) is constant, and is statistically as far as possible from the uniform distribution on 1 bit. The right definition of randomness extractors, in the sense that they exist, and are still useful (as we’ll see) for the purpose we have of purification, was given by Nisan and Zuckerman [NZ96]. It allows using not one function f, but many, and demands that most of them will purify any given source.

n r Definition 9.3 (Extractor). A sequence of functions F = (f1, f2, . . . , ft) with fi : {0, 1} → {0, 1} is called an (n, k)-extractor, if for every k-source D, all but -fraction of the fi satisfy |fi(D)−Ur|1 ≤ . Remark 9.4. In most papers on the subject the extractor F is defined differently, but essentially equivalently, as a function on two arguments: the sample from the weak source D, as well as a (uniformly distributed) index i ∈ [t], so that F (i, x) = fi(x). The index is called a seed, and F is often called a seeded extractor. Let us discuss how to use an extractor to emulate BPP algorithms while only accessing weak random sources with sufficient entropy. Fix some probabilistic algorithm A for some decision problem, and an input x for it. Assume that on a truly random sequence y ∈ {0, 1}r, its output A(x, y) errs with probability (say) at most 1/5. Assume further that we an (n, k)-extractor with output size r and error . The emulator would appeal to some k-source D for an n-bit sample z, and compute from it the set of r-bit sequences yi = fi(z). Then, it would plug each of the yi to A, computing all outputs A(x, yi), and then returning their majority value. Let us analyze the quality

125This is a well known fact for Shannon’s entropy, and is actually easy to see for min-entropy.

120 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

of this new algorithm. We know that an -fraction of the seeds i, the function fi may fail to produce a nearly uniformly random (up to ) sequence when applied to a sample from D. These seeds can produce an erroneous value. But each of the other seeds generate a nearly uniform sequence yi, and so when used in A errs with probability at most 1/5 + . By Markov’s inequality the probability that a total of at least half the seeds lead to an error is therefore at most 2/5 + 4 < 1/2. Note that for such an emulation to be efficient, namely polynomial time in r, puts some restric- O(1) tions on the extractor F . First, we must have t ≤ r . Next, each fi should be computable in poly(r) time. Thus in particular we must have that n ≤ rO(1). Finally, as k ≤ r, this implies we can only hope to use sources with polynomial entropy k ≥ nΩ(1). Later applications of randomness extractors are interesting with different parameters, so let us consider all the parameters in this definition of extractors, and the natural goals in optimizing them. We will express all parameters as functions of n, the sample size from the distribution D. First, the min-entropy k; it would be nice to extract from sources of any k (although it seems clear that the larger k is, the easier the task). Next is the output length r—how many (nearly) pure random bits are produced; as mentioned, r ≤ k, and it is natural to make it as close to k as possible. Next is the “error” parameter ; which we would like to make as small as possible. Finally, the number t of functions used; again this should be minimized, as we have to evaluate them all (for efficiency a natural goal is to make t polynomial in n). Early results [Sip88, RTS00] showed that at least existentially, one can simultaneously get the best of all worlds, namely get optimal values for all parameters: output entropy r being almost equal to the input entropy k, a polynomial number of functions t and inverse polynomial error . Of course, such existential results do not give bounds on the efficiency of the extractor, but rather clarify the limits of what we should aim for in efficient constructions.

Theorem 9.5. For every n and k ≤ n there exist an (n, k)-extractor F with output length r ≥ .99k, ≤ 1/n and t = nO(1). Indeed, a random family of t functions F will be such an extractor with probability approaching 1 as n grows. Furthermore, these parameters are essentially the best possible.

9.2 Explicit constructions of extractors Of course, the main issue is that we need to actually use extractors, so an existence theorem will not do—we need an explicit construction of efficiently computable extractors F with good parameters126. The road to achieving this goal, detailed in the surveys above, was long and meandering, involving boosting from weaker classes of sources like “block-sources” and “somewhere-random sources”, using a variety of weaker notions of extractors like “condensers” and “mergers”. We stress that all these constructs gave rise to new and different notions of reduction! We now highlight only a few milestones of explicit extractors that gradually lowered the entropy requirements of the source, from linear, to polynomial, to anything at all. We also highlight the diverse intellectual and technical origins that gave rise to different constructions, which further points to the interconnectedness of the pseudo-random world. In the following discussion, we assume for simplicity = 1/n. We only focus on minimizing the entropy k of the source127, and the number of functions (or seeds) t, and maximizing the output length r of the source (which cannot exceed k). At the end of this historical account we give one explicit construction of an extractor, and another application of extractors in which weak sources are not mentioned.

126Note that this is another instance of the “hay in haystack” problem discussed in the previous subsection. 127Which we assume for notational simplicity is at least 10 log n.

121 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

The very first explicit extractor was given by Zuckerman [Zuc90, Zuc91]. It could only handle entropy k ≥ Ω(n) and outputs r ≥ k/10 nearly uniform bits. It involves a sophisticated combination of randomness-efficient sampling and hashing. After few improvements, Ta-Shma introduced and used mergers to make a huge leap. He showed how to extract from a source of any min-entropy k ≥ poly(log n)), output length r essentially as large as k, with only a slightly super-polynomial number of seeds t = exp(poly(log n)). The quest became reducing the number of seeds. The next milestone we mention is the explicit extractor of Trevisan [Tre99], which achieved the optimal t = poly(n) but only for polynomial entropy k = nΩ(1) and only with output length r > k.99. This sufficed to completely resolve the BPP emulation problem by weak sources discussed above! Moreover, this construction was conceptually very different than all previous constructions. Indeed, it was a reduction. Trevisan’s extractor interprets the input as a truth table of a computationally hard function g, and the functions fi output values of g on judicially chosen domain elements. The construction and analysis follow the “NW-generator” constructions [NW94, IW97] mentioned in Section 7.2. Let us remark on how insightful and surprising this construction was. First, it uses an object (pseudo-random generator) which by definition works only in the computational setting, and converts it to another object (extractor) which by definition is information theoretic. Moreover, these two type of notions seem to work in opposite directions: pseudo-random generators start with few, truly random bits and generate a low-entropy distribution on many bits, whereas in extractors one starts with a distribution on many bits that has some entropy, and generates few, purely random bits. Nevertheless, Trevisan shows that the “NW-generator”, essentially as is, becomes an extractor when viewed from the right perspective! This story continue to evolve with many ideas and papers, and finally reached a happy ending: efficient extractors that are essentially optimal in all parameters.

Theorem 9.6. For every k = k(n) there is a polynomial time computable family F = {Fn} of (n, k)-extractors, with output length r ≥ .99k, ≤ 1/n and t = nO(1). The first such explicit construction was given by Guruswami, Vadhan and Umans [GUV09]. Their extractor interprets the input as a message in an error-correcting code, and the functions fi output the different symbols in the encoding of that message. The construction and analysis relies specifically on the optimal list-decodable codes of [PV05, GR08]. Shortly after, a different construction was given by Dvir and Wigderson [DW11]. Their extractor interprets the input as a low degree curve over a finite field, and the functions fi output the different points on the curve. The construction and analysis rely on the polynomial method and its use in Dvir’s proof [Dvi09] of the finite-field Kakeya conjecture in finite-field geometry. The two last results draw on and connect to different mathematical areas, an aspect shared by many other works on extractors. We also note again that in many different areas and results within computer science in which extractors arise and are used do not explicitly ask for purification of randomness—indeed in some, randomness is not present in the application at all. Nonethe- less extractors seem like a versatile tool used this way in algorithms, networks, data structures, cryptography and more. We conclude with an explicit construction of an extractor, from yet a different origin, random walks on expander graphs. Indeed, this may be called the proto-extractor, as it existed before extractors were defined, but was realized to be an extractor only afterwards. Moreover, it was used as part of many subsequent extractor constructions. This extractor has relatively weak parameters; for some fixed constant α the entropy of the source k must be at least (1 − α)n, the output length is r ≥ αk, and a constant error . Still, even obtaining this (without hindsight) is highly nontrivial.

122 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

We shall need the explicit expanders of Theorem 8.9, say with parameters c = 2 and d = 16. r 128 2 Let Gr be the 16-regular expander on 2 from that theorem . Set t = r/ , and n = r + 4(t − 1). Note that every n-bit sequence can be interpreted as a length-t path in Gr, where the first r bits specify the first vertex, and each successive 4-bit segment specifies a neighbor of the previous vertex among the 16 possible ones. Note that r ≈ 2n/4. n r Define the t functions F = (f1, f2, . . . , ft) with fi : {0, 1} → {0, 1} as follows. fi(x) is simply the (r-bit name of the) ith vertex in the path specified by x. By theorem 8.9, F can be computed in polynomial time. Theorem 9.7. Set α = (2t)/(32n) = Ω(2). Then F above is an explicit (n, k)-extractor for k = (1 − α)n, r ≥ αk and error .

The proof of this theorem follows from a remarkable sampling property of random paths in expander graphs: their t vertices, despite being a highly correlated set of r-bit strings, behave as totally independent ones when used to compute a sample average of any bounded function on {0, 1}r; the deviation from the true average decays exponentially in the number of samples t. This was first discovered (in a weaker form) by Ajtai, Komlos and Szemerédi[AKS87] (for the purpose of de-randomization small-space probabilistic algorithms), strengthened in [CW89, IZ89] for the purpose of amplifying error in probabilistic algorithms, and finally Gilman [Gil98] proved the essentially optimal bound (simplified and extended in [Hea08], from which we quote a special case in our notation, with his λ = 1/2). r Theorem 9.8 [Gil98, Hea08] Let Gr be the expander above. Fix any function g : {0, 1} → [−1, 1] with zero expectation. Then for every > 0 and every t, if y1, y2, . . . , yt are the vertices of a uniformly random path in Gr then " # 2 X − t/8 Pr g(yi) > t < 2 . i

Observe that when the yi are independent this is the classical large deviation (Bernstein/Chernoff) bound. The huge difference is that independent samples require rt random bits, whereas this theorem shows that the same estimation error can be achieved with only r + O(t) bits, which is best possible. The application to error amplification of probabilistic algorithms mentioned above shows that any algorithm using r random bits with error (say) 1/3 can be converted into one with error exp(−r) by using only O(r) bits, as opposed to the obvious r2. This may be viewed as a far more impressive than the error reduction129 discussed in Chapter 8.7. We conclude by connecting the last two theorems. They turn out to be essentially equivalent (once you match the parameters). This equivalence of extractors and (oblivious) samplers is stated by Zuckerman in [Zuc97], and the simple proof is almost by definition. Vadhan’s survey [Vad11] contains a thorough discussion of the connections of extractors to samplers, hash functions, error- correcting codes and other pseudo-random objects.

128Note that we change n of that theorem to r here, as we keep n for the input length of the extractor. 129There the error was reduced to 1/poly(r), but without adding any extra random bits at all!

123 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

10 Randomness in proofs

The introduction of randomness into proofs had a remarkable impact on theoretical computer science, with quite a number of unexpected consequences, in particular a new, powerful characterization of NP and other complexity classes. In this section we summarize the main definitions and results of this research direction. We refer the readers to the surveys in [Joh92], [Gol99], [RW00] and the references therein for more detail. We also note that in this section we do not discuss the probabilistic method, a powerful proof technique. An excellent text on it is [AS00]. Let us start again with an example. Consider the graph isomorphism problem mentioned in Section4: given two graphs G and H, determine if they are isomorphic. No polynomial-time algorithm is known for this problem. Now assume that an infinitely powerful teacher (who in particular can solve such problems), wants to convince a limited, polynomial time student, that two graphs G, H are isomorphic. This is easy—the teacher simply provides the bijection between the vertices of the two graphs, and the student can verify that edges are preserved. This is merely a rephrasing of the fact that ISO, the set of all isomorphic pairs (G, H), is in NP. But is there a similar way for the teacher to convince the student that two given graphs are not isomorphic? It is not known if ISO ∈ coNP, so we have no such short certificates for non-isomorphism. What can be done? Here is an idea from [GMW91], which allows the student and teacher more elaborate interaction, as well as coin tossing. The student challenges the teacher as follows. He (secretly) flips a coin to choose one of the two input graphs G or H. He then creates a random isomorphic copy K of the selected graph, by randomly permuting the vertex names (again with secret coin tosses). He then presents the teacher with K, who is challenged to tell if K is isomorphic to G or H. Observe that if G and H are indeed non isomorphic as claimed, then the answer is unique, and the challenge can always be met (recall that the teacher has infinite computational power). If, however, G and H are isomorphic, no teacher can guess the origin of K with probability greater than 1/2. Simply, the two random variables: a random isomorphic copy of G, and a random isomorphic copy of H, are identically distributed, and so cannot be told apart regardless of computational power. Now, to reduce the error, let the student repeat this this experiment independently 100 times, and declare that the graphs are not isomorphic unless the teacher succeeds in all of them. As the probability 100 successes when G and H are isomorphic is 2−100, this bounds the probability that the student erroneously accepts a false proof. In other words, such repeated success describes an overwhelmingly convincing interactive proof that the graphs are indeed non-isomorphic. Note that hiding the coin tosses of the student from the teacher is an absolutely essential feature of this proof system. Indeed, it is hard to imagine that a similar feat can be achieved if the teacher could spy over the student’s shoulder and know precisely the results of all coin tosses used. This intuition is wrong! A remarkable result of Goldwasser and Sipser [GS89] gives another (much more sophisticated) interactive proof system for non-isomorphism in which all coin tosses of the student are available to the teacher! Indeed, they give a completely general way of turning any “private- coin” interactive proof system (in which the teacher can’t see the student’s coin-tosses) into one that is “public-coin” (in which the teacher can see them), which has similar efficiency! The reader is encouraged to try and find an interactive proof for graph non-isomorphism, in which the only messages of the verifier to the prover are random bits.130

130Insuﬃcient hint: the public-coin proof, like the private-coin proof above, should rely on the fact that the number of isomorphic copies of G and H together is twice as large when they are non-isomorphic, than when they are isomorphic.

124 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

We now return to the general discussion. We have already discussed proof systems in sections 3.3 and6. In both, the verifier that a given witness to a given claim is indeed a proof was required to be an efficient deterministic procedure. In the spirit of the previous section, we now relax this requirement and allow the verifier to toss coins, and err with a tiny probability. To make the quantifiers in this definition clear, as well as to allow more general interaction between the prover and the verifier, it will be convenient to view a proof system for a set S (e.g. of satisfiable formulae) as a game between an all-powerful prover and the (efficient, probabilistic) verifier: both receive an input x, and the prover attempts to convince the verifier that x ∈ S. Completeness dictates that the prover succeeds for every x ∈ S. Soundness dictates that every prover fails for every x 6∈ S. In the definition of NP, both of these conditions should hold with probability 1 (in which case we may think of the verifier as deterministic). In probabilistic proof systems we relax this condition, and only require that soundness and completeness hold with high probability (e.g. 2/3, as again the error can be reduced arbitrarily via iteration and majority vote). In other words, for every input, the verifier will only rarely toss coins that will cause it to mistake the truth of the assertion. This extension of standard NP proofs was suggested independently in two papers—one of Goldwasser, Micali, and Rackoff [GMR89] (whose motivation was from cryptography, in which interactions of this sort are prevalent), and the other by Babai [Bab85] (whose motivation was to provide such interactive “certificates” for natural problems in group theory which were not known to be in coNP). While the original definitions differed (in whether the coin tosses of the verifier are known to the prover or not), the paper of Goldwasser and Sipser [GS89] mentioned above showed both models to be equivalent. This relaxation of proofs is not suggested as a substitute to the notion of mathematical truth. Rather, much like probabilistic algorithms, it is suggested to greatly increase the set of claims which can be efficiently proved in cases where tiny131 error is immaterial. As we shall see below, probabilistic proof systems yield enormous advances in computer science, while challenging our basic intuitions about the very nature of proof. We exhibit three different remarkable manifestations of that:

• Many more theorems can be eﬃciently proved. • Every theorem can be proved without revealing anything about the proof besides its validity. • Every theorem possesses written proofs which veriﬁers can check by inspecting only a handful of bits.

10.1 Interactive proof systems When the verifier is deterministic, interaction does not add power, as the prover can predict all future questions. Thus, in this case we can always assume that the prover simply sends a single message (the purported “proof ”), and based on this message the verifier decides whether to accept or reject the common input x as a member of the target set S. In other words, with a deterministic verifier, interactive proofs can only prove statements in NP. When the verifier is probabilistic, interaction may add power. We thus allow both parties to toss coins, and consider a (randomized) interaction between them. It may be viewed as an “interrogation” by a persistent student, asking the teacher a series of “tough” questions in succession

131And we remind the reader again that error can be made exponentially tiny without eﬀecting eﬃciency by much!

125 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

in order to be convinced of correctness (or catch a bug). Since the verifier ought to be efficient (i.e., run in time polynomial in |x|), the number of such rounds of questions is bounded by a polynomial132. Definition 10.1 (The class IP,[GMR89], [Bab85]). The class IP (for Interactive Proofs) contains all sets S for which there is a probabilistic polynomial-time verifier that accepts every x ∈ S with probability 1 (after interacting with some adequate prover), but rejects any x 6∈ S with probability at least 1/2 (no matter what strategy is employed by the prover, or how computationally strong it is). We have already seen the potential power of such proofs in the example of graph non-isomorphism above (in 10), and several others examples were initially given. But the full power of IP began to unfold only after an even stronger proof system called MIP was suggested by Ben-Or et al. [BOGKW89] (motivated by cryptographic considerations). In MIP (for multiple-prover interactive proof) the verifier interacts with multiple provers, who are not allowed to communicate with each other. We describe some of the evolution of works and ideas leading to this understanding. A lively account of this rapid progress is given by Babai [Bab90]. One milestone, of Lund, Fortnow, Karloff and Nisan [LFKN90] was showing that IP proofs can be given to every set in coNP (indeed, much more, but for classes we have not defined in this book). Thus, in particular, tautologies have short interactive proofs. Reall that we don’t expect these to have standard NP-proofs, as this will imply NP = coNP (see discussion in Section 3.5, and in particular Conjecture 3.8). Theorem 10.2 [LFKN90] coN P ⊆ IP. As mentioned, this is just a special case of the main theorem in [LFKN90], which we state and sketch at the end of this section. This paper was shortly followed by a complete characterization of IP by Shamir [Sha92]. He proved it equivalent to PSPACE, the class of functions computable with polynomial memory (and possibly exponential time). We note that this class contains problems which seem much harder than NP and coNP, e.g. finding optimal strategies of games. Theorem 10.3 [Sha92] IP = PSPACE. It is illuminating to give an informal consequence of this theorem, which I find mind-blowing. Suppose that some superior extra-terrestrial being (let us call it E.T. for short) arrived on Earth and claimed that their civilization has studied Chess and has found that “White has a winning strategy133!”. Is there a way to check or refute this claim? While we have some very good Chess players and programs, our own civilization has no means today of ascertaining such a claim. Simply, the only known way (algorithm) we have is brute force; expanding the complete game-tree for Chess. But this tree is exponential in the number of moves, a vast number which puts this computation way beyond any conceivable future technology. Of course, we can offer our best players (human or not) to compete playing Black with E.T. But suppose they all lose in all games; all we can conclude

132Restricting the number of rounds to constant, as was suggested in the original paper of Babai [Bab85] leads to the extremely interesting “Arthur-Merlin” complexity classes AM and MA, which sit just above NP. We will not deﬁne and study them here but note that they were extensively studied, and that the interactive proof above for graph isomorphism above puts this problem in the class AM. 133Recall that a strategy for a player in Chess, or any perfect information game, is simply a prescription of a legal move for that player in every possible conﬁguration of the game. It is a winning strategy is it guarantees a win for that player, regardless what strategy the opponent chooses.

126 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

is that E.T. is a better player, something far short of verifying its claim that White has a winning strategy. However, the theorem above does provide an efficient way to verify it! To explain this subtle connection, consider first a ridiculously stupid attempt at verification. Let us match E.T. not with our best player, but with our dumbest; one which picks each move completely at random, from all available legal moves at the given configuration. Call this probabilistic strategy (for Black) Random Play (or R.P. for short). Needless to say, even a beginner playing as White would beat R.P. at Chess, and E.T. certainly will too. The next observation is that R.P. stupid as it may seem, is optimal for some other games, e.g. Rock-Paper-Scissors134. But of course Rock-Paper-Scissors has nothing to do with Chess. Amazingly, Shamir’s theorem allows us to make the random play strategy useful in games intimately related to Chess! The theorem provides a new kind of reduction: a way to convert Chess to a new 2-player game, G, with the following properties. 1. First, the conversion is efficient: the rules of the game G are easily understood by mortals like us. In particular, which moves are legal in each configuration of G are easily computable, and so R.P. in this game can be implemented easily. 2. Second, the two games are equivalent in the following sense. White has a winning strategy in the new game G if and only if White has a winning strategy in Chess. So, in particular E.T. can convert his claimed winning Chess strategy (if one exists) into a winning strategy for G. 3. Finally, G has the property that random play R.P. for Black is nearly optimal—it does as well as the best Black strategy with probability 1/2.

So, let us spell out what this reduction implies. If White has a winning strategy in Chess (and E.T. uses it to play optimally in G, as it can by (2)), then R.P. would still lose every time in G. But if White does not have a winning strategy in Chess, then by (3) E.T. cannot win G with higher than 1/2 probability against an optimal Black strategy. Thus, if E.T. wins a 100 games in a row against R.P., we have probability 1 − 2−100 that White indeed has a winning strategy in Chess. Three comments may answer some questions the reader may have about the result above. First, the exact same would work for Go instead of Chess, and indeed any reasonable game we play. Second, if we appropriately generalize Chess or Go (and make it a complete problem for the class PSPACE, which happens to be the natural home of such 2-player perfect information games), then this game theoretic interpretation above is actually equivalent to Theorem 10.3. Thirdly, if P = PSPACE (which would imply P = NP, and which no one believes, but is still a mathematical possibility), then there is a fast algorithm to determine optimal strategies in Chess, Go, etc. This success story, of completely understanding the surprising power of interactive proofs, required the confluence and integration of ideas from different “corners” of computational complexity, again exposing the power of its methodology and the flow of cross-fertilizing ideas between different subareas. The sequence of results leading to the original proof uses in particular the following ingredients. Elaborating on these is unfortunately beyond our scope.

• program checking and testing [BK89, BLR93]. • hardness ampliﬁcation from average-case to worst-case hardness [Lip91, BF90].

134Ignore the fact that this game is of a somewhat diﬀerent type of game, in which moves are simultaneous. There are other examples. Indeed, the result of Goldwasser and Sipser [GS89] mentioned in the previous subsection reveals surprising power of random play in a related context.

127 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• The power of counting and the Permanent polynomial to capture coNP and more generally bounded alternation [Tod91]. • The multi-prover analogue [BOGKW89] of the basic interactive proof model, motivated by zero-knowledge proofs (see below).

• The structure of the complexity class PSPACE. In particularly that non-determinism does not add power to this class [Sav70], and the structure of a complete problem for it (QBF , the satisfiability of quantified Boolean formulas). A central technical tool which emerged, and would play a major role in Section 10.3 (as well as in new lower bound proofs), is arithmetization, the arithmetic encoding of Boolean formulae by polynomials, and the ultra-fast verification of their properties. Arithmetization and its consequences proved instrumental to some circuit lower bounds; its impact and limitations are mentioned towards the end of Chapter 5.1. We conclude by noting that the exact power of the stronger MIP proof system was also determined completely, by Babai, Fortnow and Lund [BFL91]. Here too it is equivalent to a natural complexity class, in this case NEXP (the exponential-time analog of NP), of all languages computed in non-deterministic exponential time. Theorem 10.4 [BFL91] MIP = NEXP.

10.2 Zero-knowledge proof systems Assume you are a junior mathematician who just found a proof of the Riemann Hypothesis. You want to convince the mathematical world of your achievement, but you are extremely paranoid that if you revealed the proof to anyone (perhaps a senior expert), he or she will claim it was their own. While unlikely, this could be devastating to your career. Is there a way to prevent this from happening? Can you convince everyone you know a proof, without giving anyone a clue about it? Hold on. The thrust of this section is not to prove more theorems, but rather to have proofs with additional properties. Randomized and interactive veriﬁcation procedures as in Section 10.1 allow the (meaningful) introduction of zero-knowledge proofs, which are proofs that yield nothing beyond their own validity. Such proofs seem impossible—how can you convince anyone of anything they do not already know, without giving them any information? In mathematics, whenever we cannot prove a theorem ourselves, we feel that seeing a proof will necessarily teach us something we did not know, beyond the fact that it is true! Well, the interactive proof given above, that two graphs are non-isomorphic, at least suggests that in some special cases zero-knowledge proofs are possible! Note that in each round of that proof, the student knew perfectly well what the answer to his challenge was, so he learned nothing from the teacher’s answer. In other words, if the graphs were indeed non-isomorphic (namely, the claim to be proved was true), the student could have generated the conversation with the teacher, without actually interacting with him! After all, in that case the student knows the unique correct answer to every question he generated. And no new knowledge can be gained from a conversation you can have with yourself! Despite this, the actual conversation taking place between them, a teacher’s repeated success in identifying the correct graphs in many challenges actually convinced the student that indeed the graphs were non-isomorphic. In short, this interactive proof (at least

128 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

intuitively) is a zero-knowledge proof135! It is convincing, and reveals nothing to the student that he didn’t already know, beyond the truth of the claim itself. How can we define this notion, of zero-knowledge proofs, for general interactive proofs? The motivation, formal definition and some examples of this remarkable notion were given in the same seminal paper [GMR89], which defined interactive proofs. The definition is quite subtle and technical, and we only sketch the essence in high-level terms (more details are provided in Chapter 18 on cryptography). Extending the intuition from the example above, we can demand that on every correct claim, the verifier should be able to efficiently generate, by himself, (the probability distribution of) his conversation with the prover. This turns out to be unnecessarily stringent. Indeed, we would be satisfied if what the verifier can generate by himself is computationally indistinguishable from the actual conversation (defined formally in Section 7.3). In this sense, zero-knowledge proofs mean that no knowledge is leaked by the prover, which can ever be made use of by any efficient algorithm (like the verifier). Now, which theorems have zero-knowledge proofs? Well, if the verifier can determine the answer with no aid, it is trivial. Thus, any set in BPP has a zero-knowledge proof, in which the prover says nothing (and the verifier decides by itself). A few examples believed outside BPP like Graph Non-Isomorphism, are known to have such proofs unconditionally. What is perhaps astonishing is that using the standard assumption of cryptography, namely that one-way functions exist (see Section 4.5), then zero-knowledge proofs can be given for every theorem of interest! Goldreich, Micali, and Wigderson [GMW91] proved: Theorem 10.5 [GMW91] Assume the existence of one-way functions. Then every set in NP has a zero-knowledge interactive proof. The assumption is essential; a converse to this theorem was (formulated and) proved in [OW93]. The proof of the zero-knowledge theorem above again exemplifies the power of reductions and completeness! It is proved in two steps. First, [GMW91] gives a zero-knowledge proof for statements of the form “a given graph is 3-colorable”. We will not explain the protocol, but note that it uses specific combinatorial properties of this problem136. Second, it uses the NP-completeness of this 3COL problem to infer that all NP sets have a zero-knowledge proof. This uses the strong form of reductions, mentioned after Theorem 3.12, which allows efficient translation of witnesses, not just instances. Let us see such a reduction in action, justifying the interpretation above of the zero-knowledge theorem. Suppose that indeed you proved the Riemann Hypothesis, and were nervous to reveal the proof lest the listener rush to publish it first. With the zero-knowledge proofs of 3-colored maps, you could convince anyone, beyond any reasonable doubt, that you indeed have such a proof of the Riemnann Hypothesis, in a way which will reveal no information about it. You proceed as follows. First, use the efficient algorithm implicit in the proof that 3COL is NP-complete, to translate the statement of the Riemann Hypothesis into a graph, and to translate your proof of it into the appropriate legal 3-coloring of that graph. Now, use the protocol of [GMW91] for 3COL to convince your listener of this fact instead. Note that the listener could carry out the first part of the reduction (from Riemann Hypothesis to a graph) by himself, so knows that you are proving an equivalent statement!

135There is a subtlety, explained in [GMW91], which necessitates altering the original proof so as to formally make it zero-knowledge. 136In much the same sense as the combinatorial properties of graph non-isomorphism were used in its zero-knowledge proof.

129 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

But the grand impact of this theorem is not in the (important) application above to copy- rights and plagiarism protection. Zero-knowledge proofs are a major tool for forcing participants in cryptographic protocols to behave correctly, without compromising anyone’s privacy [GMW91]. In essence (and hiding numerous complications), zero-knowledge proofs allow parties in cryptographic protocols to convince others that their messages (computed partly depending on their private secrets) were computed in accordance with the protocol without revealing theses secrets, by proving so in zero-knowledge (where these secrets are the proof that is never revealed). Let us elaborate the conceptual contribution of this and subsequent work to simplifying the task of protocol design for general cryptographic problems. We note that even defining the many intuitive notions below is highly nontrivial, and refer the reader forward again to the cryptography Chapter 18 for more detail. The paper [GMW91] gives a (new kind of) reduction: it converts a protocol in which privacy is guaranteed only if all parties follow it137, and automatically generates a protocol in which privacy is guaranteed even if some parties are faulty or even maliciously deviate from protocol138. Soon afterwards, Yao [Yao86] designed his celebrated secure evaluation protocol for honest parties (extended from 2 parties to any number of parties in [GMW87]). These protocols139 offer yet a completely different reduction, converting an arbitrary circuit whose inputs are distributed among different parties, into a protocol (for honest players) which evaluates this circuit on these inputs, without leaking any information to any subset of the players beyond what the output itself reveals. As a simple example from Yao’s paper that might demonstrate this achievement, try designing such a protocol for two parties, each holding an n-bit integer, representing two millionaires trying to figure out who is richer without revealing their worth. Another example is holding an election: n people each hold a bit (say), and try to figure out the majority vote. Again, everyone is honest, and will follow every instruction of the protocol to the letter! They are simply curious, so the protocol should be designed so that no subset of them learns anything which the output itself does not reveal about inputs which are not theirs. The combination of a secure evaluation protocol for any function that is private assuming honest players, and the compiler of such a protocol making it resilient against malicious parties, yields a private and fault-tolerant implementation of just about any cryptographic task! For a good example of the complexity of such tasks which now become implementable, consider how a group of untrusting parties can play a game of poker over the telephone. No physical implements (like cards with opaque backs for Poker) are allowed (or needed)—only digital communication and trap-door functions!

10.3 Probabilistically checkable proofs (and hardness of approximation) In this section we turn to one of the deepest and most surprising discoveries about the power of probabilistic proofs, and its consequences to the limits of approximation algorithms. We return to the non-interactive model, in which the veriﬁer receives a (alleged) written proof. But now we restrict its access to the proof so as to read only a tiny part of it (which may be randomly selected). It is remarkable to note that as natural as written, non-interactive proofs are to us, the model we discuss in this section arose very indirectly. It was derived from the interactive

137Designing such a protocol for honest parties is a highly non-trivial task by itself which we presently discuss. 138As in all such reductions, what is actually shown is that the ability of some parties to gain access to secrets of others entails an eﬃcient algorithm to invert a one-way function 139Which rely on the existence of trap-door functions.

130 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

proof model MIP of [BOGKW89] mentioned above, in which a verifier communicates with several, mutually non-communicating provers. The connection was simple and powerful observation of [FRS88] showing that this later model MIP,(unlike its single-prover sibling IP), is equivalent to a non-interactive, written proof one (like NP), but which (unlike NP) restricts the verifier to few, random probes into the proof140. An excellent familiar setting of such “lazy verification” is when a referee is trying to decide the correctness of a long (say 100-page) proof by sampling a few (say 10) lines of the proof and checking only them. This seems useless; how can one hope to detect a single “bug” unless the entire proof is read? However, this intuition turns out to be valid only for the “natural” way of writing down proofs, in which single isolated bugs may indeed exist! Surprisingly, this intuition fails when robust formats of proofs are used (and, as usual, when we tolerate a tiny probability of error). Such robust proof systems are called PCPs (for Probabilistically Checkable Proofs). Loosely speaking, a PCP system for a set S consists of a probabilistic polynomial-time verifier having access to individual bits in a string representing the (alleged) proof141. The verifier tosses coins and accordingly accesses only a constant(!) number of the bits in the alleged proof. It should accept every x ∈ S with probability 1 (when given a real proof, adequately encoded), but rejects any x 6∈ S with probability at least 1/2 (no matter to which “alleged proof” it is given). A long sequence of ideas and papers, surveyed by Arora in [Aro94] and Sudan in [Sud96], in which the number of random probes to the written alleged proof was finally reduced to a fixed constant, culminated in the “PCP theorem”, a powerful new characterization NP, by Arora et al.: Theorem 10.6 The PCP theorem [[ALM+98]] Every set in NP has a PCP system. Further- more, there exists a polynomial-time procedure for converting any NP-witness to the corresponding “robust” PCP-proof. Indeed, the proof of the PCP theorem suggests a new way of writing “robust” proofs, in which any bug must “spread” all over. Equivalently, if the probability of finding a bug found in these handful of bits scanned by the verifier is small (say ≤ 1/10), then the theorem is correct! The remarkable PCP theorem was proved with a rather complex and technical proof, which resisted significant simplification for over a decade. However, a conceptually different proof which is very elegant and much simpler was given later by Dinur [Din07]. The reader may find a syntactic similarity between PCPs and error-correcting codes. In the latter, if the probability of a bit being flipped in an encoded message is small, then the message can be correctly recovered from its noisy encoding. Indeed there are deep connections, and the cross-fertilization between these two areas has been very significant. The PCP theorem has revolutionized our ability to argue that certain optimization problems are not only hard to solve exactly, but even to get a rough approximation. We note that in practice, a near-optimal solution to a hard problem may be almost as good as an optimal one. But for decades, until the PCP theorem came along, we had almost no means of proving hardness of approximation results. 140The proof of this observation goes roughly as follows. In one direction, a multi-prover proof can be converted into a written one by writing down all provers’ answers to all possible queries by the verifier. In the other direction (which is the more subtle one, and does not work with a single prover) a written proof becomes the strategy of the (say) two provers. Of course, the verifier should not trust them, and so makes sure that they give consistent answers on the queries he would have made to the written proof. The fact that the provers cannot communicate makes this possible. In both directions, the number of bit queries to the written proof is roughly the same as the number of communicated bits between the verifier and the provers. 141In case of NP-proofs the length of the proof is polynomial in the length of the input.

131 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

The connection between the probabilistically checkable proofs and hardness of approximation was discovered by Feige et al. [FGL+96], and is elaborated on in the surveys above. Let us explain how one obtains an NP-hard approximation problem from the PCP theorem. Consider the behavior of the PCP verifier on a given instance (say, of SAT ). It can be described by a set of local tests on the given PCP proof; each test specifies the subset of bits to be read, and the set of values in these locations that would cause the verifier to accept. Now, if we consider the bits in a purported PCP-proof as Boolean variables, the question of acceptance by the verifier becomes a constraint satisfaction problem (CSP, see section 4.3). The PCP theorem guarantees that either all constraints are satisfiable (if it was a “yes” instance) or that at most 1/10-fraction of them are (if it was a “no” instance). This constitutes a reduction from SAT to this CSP. Approximating the maximum fraction of satisfied constraints in this CSP to within a factor < 10 would lead to an algorithm for solving SAT (exactly), and so approximating this CSP is NP-hard. The approximation problem above seems contrived, and perhaps does not arise in practice. But again, once we have it, we can try to use it and prove hardness of other, more natural approximation problems. As it happens, reductions between approximation problems are typically much harder to prove than standard NP-completeness results, and often require significant analytic machinery. We mention two examples of the strongest such inapproximability results, both due to H˚astad[H˚as99], [H˚as01]. Both are nearly tight, in that it is NP-hard to approximate the solution by the factor given, but trivial to do so with slightly a bigger factor. In both ε > 0 can be an arbitrarily small constant.

• Linear equations. Given a linear system of equations over F2, approximate the maximum number of mutually satisﬁable ones, to within a factor of 2 − ε (clearly, a factor 2 is trivial: a random assignment will do). • Clique. Given a graph with n vertices, approximate its maximum clique size to within a factor n1−ε (clearly, a factor n is trivial: one vertex will do). For many approximation problems the best known approximation ratio achieved by the (currently) best eﬃcient algorithm does not match the (currently) best NP-hardness result supplied by the PCP theorem. These gaps led to the development of the Unique Games problem and UGC, discussed in Section 4.3, which closes these gaps in numerous approximation problems.

132 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

11 Quantum Computing

This chapter describes a unique and exciting interaction between computational complexity and physics, which probes the nature of reality and brings a new perspective into its study. We will discuss some of the many facets of this interaction. There are many excellent texts on this broad subject, including [NC10, KSV02, Aar13a], each with a different perspective and style. Let us return to the most basic question: what are all problems which can be solved efficiently? In the beginning of this book we defined it to be the class P, those problems solvable in deterministic polynomial time. Rapid progress in computer technology made them run faster, but the class P remained robust under all these models. The first potential change occurred when people realized that we can tap in to a natural resource, randomness. It seems that nature provides us with unlimited, free random bits, and we can incorporate them into the computation of Turing machines. This allows us (if we are willing to tolerate errors with small probability) to broaden the class of tractable problems to those having polynomial time probabilistic algorithms, namely the class BPP. While we don’t know if randomness really buys extra power (and conjecture that it doesn’t—see Section 7.2), many probabilistic algorithms are in current use simply since the best deterministic algorithms we currently have are much (often exponentially) slower. It stands to reason that we should add to our computers and algorithms everything nature provides which seems to increase their power. Indeed, if our computers cannot efficiently simulate some natural phenomena, we should integrate in them the underlying mechanism enabling nature to be more efficient. Feynman [Fey82] has noted that the obvious classical algorithm (even using randomness) for simulating the evolution of a quantum system on n particles requires exponential time in n. He thus suggested that computer algorithms should be equipped with “quantum mechanical” gates, to enable such efficient simulation (and possibly make them more powerful than classical computers). A similar idea was put forth in Russia by Manin [Man80]. A series of papers [Ben80,Deu85,BV97,Yao93,AKN98] then completely formalized the concept of a quantum mechanical Turing machine, which we informally describe below. Restricting it to run in polynomial time we get the class BQP, of functions efficiently computable by such algorithms. Observe that like BPP, also BQP allows small error (which again can be made arbitrarily small by repetition). Definition 11.1 (The class BQP [BV97]). A function f : I → I is in BQP if there exists a quantum polynomial-time algorithm A, such that for every input x, Pr[A(x) 6= f(x)] ≤ 1/3. We shall return to discuss the power of this class, and first explain what a quantum algorithm is. How does a quantum algorithm work? It turns out that to understand that one does not need to know any quantum mechanics142. Let us explain it in analogy with deterministic and probabilistic algorithms that we have already met. It would be useful to do so from the viewpoint of how the entire “state” of each of these types algorithms evolves over time. Every algorithm evolves a state, the content of its memory of (say) n bits, via a sequence of local operations (each acting on a few bits). The different types of algorithms differ in the nature of a state, the local operations allowed, and the definition of the output of that process. In all of them, the initial state contains the input to the problem in a designated location in memory (with all other bits set to a default value, say, 0’s). In a deterministic algorithm, the state is simply the value of these bits, a vector x ∈ {0, 1}n.A single operation picks e.g. three of them and uses their current value to replace them with a new

142Indeed, it may be viewed as a language to explain many of the principles of quantum mechanics.

133 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

one, according to any function g : I3 → I3. For example, one such 3-bit function, called the Toffoli gate, writes in one bit position the XOR of its current value with the AND of the other two bits (this single function can simulate the standard Boolean gates ∨, ∧, ¬). When the machine halts, the output of this computation is the contents of some designated subset of the bits. Summarizing, the evolution of a deterministic algorithm takes place in the discrete space x ∈ {0, 1}n. In a probabilistic algorithm, the local operation can be probabilistic. For example, in one 1 step it can apply, with probability say 4 , the Toffoli gate to three specific bit locations, and with 3 probability 4 leave the bits intact. Accordingly, the state of the algorithm over time is a random 143 P variable, which may be viewed as a convex combination x∈{0,1}n pxx over n-bit sequences x. So, the local operations evolve the probability vector p = (px) over time. The output again resides in some specified bit-locations, but is now a random variable over Boolean vectors as well (distributed as the marginal of the distribution in these locations). So, the evolution of a probabilistic algorithm n takes place in R2 , with the vectors x ∈ {0, 1}n serving as a natural basis for this space. In a quantum algorithm the state is again viewed as a linear combination (called a superposition, P or a wave function) x∈{0,1}n αxx, only that now the coefficients can take complex values, and the 144 vector of coefficients (called amplitudes) α = (αx) must have unit norm in L2 . A local operation can take, as before, some constant number of bits (called qubits in this setting) and perform a (norm preserving) unitary linear operation on them (which, to formally be an action on the entire state, is tensored with the identity operator on the remaining qubits). An important example is the Hadamard gate, acting on one qubit. Being a linear operation we can describe it by its action on a basis: it sends the state 0 to ( √1 0 + √1 1), and sends the state 1 to ( √1 0 − √1 1). It remains to 2 2 2 2 define the output of an algorithm, which like the input should be again a Boolean vector. This is obtained by so-called measurement, which we now define. Assume for simplicity the output is the P 2n full contents of the memory, and the final state is x∈{0,1}n αxx in C . As α is a unit vector, the 2 145 vector px = |αx| is a probability vector, and the output is defined to be x with probability px . n Summarizing, the evolution of a quantum algorithm takes place (on the unit sphere) in C2 , after which a measurement converts the final state into a probabilistic output. A few comments are in order. First, it seems that the number of possible gates is infinite, but in fact just like in classical computation a finite set of elementary operations suffice. Indeed the (classical) Toffoli gate and the (quantum) Hadamard gate together form a universal set of gates. Second146, it turns out that complex numbers are not really essential; real numbers suffice, as long as they can be also negative—as we’ll see, this seems to be the source of power of quantum algorithms over probabilistic ones. Finally, quantum algorithms can toss coins: note that applying the Hadamard gate to a single fixed qubit (say 0), and then measuring the outcome, results in a 1 1 perfect coin toss, which is 0 with probability 2 and 1 with probability 2 . It follows that quantum computing can simulate probabilistic computing147! This last point leads to: Theorem 11.2. BPP ⊆ BQP

143 P Namely, px ≥ 0 for all x, and x∈{0,1}n px = 1. In other words, p is a non-negative vector of unit norm in L1. 144 P 2 Namely x∈{0,1}n |αx| = 1 145If the output is designated to only be a subset of the bits, we similarly give each Boolean output a probability which is the total square length in α of full sequences containing it. 146Which follows from the First but can be seen directly. 147While we only allowed a measurement at the very last step of a quantum algorithms, one can deﬁne them alternatively to allow measurements at any step—this does not change their power—and so they can toss coins at any step.

134 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

So, what else is in BQP? Shor’s breakthrough paper [Sho94] supplied the most stunning examples, integer factoring and discrete logarithms discussed in Section 4.5. Theorem 11.3 [Sho94] Factoring integers and computing discrete logarithms are in BQP. How do these algorithms work? What do they do that classical algorithms can’t? Both quantum and probabilistic algorithms seem to “simultaneously” act on all 2n binary sequences, so this alone is not the source of power. The buzzword answer is interference, which should be understood in the same intuitive sense you learned in high school, of (ocean, electromagnetic, sound, etc.) waves interfering (constructively or destructively). Having negative coefficients means that quantum algorithms can generate cancellations at this exponential scale, which decreases or eliminates the probability of unwanted outcomes, and thus increases the probability of desired outcomes by unitarity. This interference is something that cannot happen in probabilistic algorithms, as all coefficients of the state vector are non-negative. Thus, probabilistic algorithms in practice evolve just a sample of the probability distribution (as opposed to physically maintaining the exponentially long state vector), whereas for a quantum algorithm to work the whole superposition has to “exist” and evolve. Let us try to probe this magical power of interference a bit, discussing a key aspect of Shor’s algorithm. An important subroutine of that algorithm computes the discrete Fourier transform (DFT) of the state, over an exponentially large Abelian group ZN . How can one compute an exponentially large linear transformation in polynomial time? Let me demonstrate it by a simpler n subroutine used in Simon’s algorithm [Sim97] for computing the DFT over the Boolean cube (Z2) (this work indeed inspired Shor!). The algorithm takes only one line: simply apply the Hadamard gate on each of the n bits in sequence. Please check that the tensor product of the n 2 × 2 matrices n n n describing the Hadamard gate is the 2 ×2 matrix describing DFT over (Z2) . To see interference in action, consider the output of the DFT, when applied to a state vector in which all states have the same amplitude (which is 2−n/2). It is not hard to see that the result is a state in which the all-0 vector has a nonzero (indeed 1) amplitude, and amplitudes of all other vectors became zero. So, the amplitude of this all-0 vector increased exponentially by “constructive” interference, whereas the amplitude of all other vectors was diminished to zero by “destructive” interference (of course, this is just an intuitive description of a simple fact in linear algebra). In a similar but far more sophisticated manner, Shor applies the DFT over ZN (where N depends on the integer to be factored) to evolve a certain state vector, and interference causes the output to be (concentrated near) the non-trivial factors of that integer (if exist) with large amplitudes, while diminishing all other (exponentially many) alternative states. What other problems can be solved efficiently by quantum algorithms for which classical ones are not known? The general technique of Grover [Gro96] offers a quadratic quantum speed-up over classical algorithms for abstract search problems. But a possible superpolynomial gap, as Shor’s algorithm may provide, has only relatively few additional examples, most of which also have a similar number-theoretic or algebraic flavor (see e.g. the survey [CvD10] and the more recent [EHKS14]). In many, the essence of the algorithms is finding some periodic structure using a fast Fourier transform (FFT) algorithm in some appropriate group, where “fast” means (classical) time N(log N)c where N is the size of the group. The quantum “parallelism” described above shaves off the factor N (which is typically exponential in the input size n), resulting in an quantum algorithm of time complexity (log N)c = poly(n). All Abelian groups have a fast Fourier transform, and it is natural to attempt and generalize such FFTs for non-Abelian groups (which instead of the characters compute the irreducible representations) to possibly solve other problems. A key challenge of this type is the Graph Isomorphism problem (which was mentioned in this book a

135 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

few times). While the (seemingly required) quantum version of the FFT is known [Bea97] for the group in question, the symmetric group Sn, we have no idea how to use it for an efficient quantum algorithm for graph isomorphism. Another challenging task is the invention of new ways to use quantum interference, possibly towards problems of a different nature. One interesting technique, which has yet to suggest a possible quantum exponential speed-up over classical algorithms is the quantum walk on graphs, which was initiated by Farhi and Gutmann [FG98] with great many follow-up works (see [CCD+03] for a provable exponential gap in a black-box model). A completely different proposal of Aaronson and Arkhipov [AA11] is to utilize the behavior of non-interacting bosons in linear optics, to efficiently solve a certain sampling problem related to the Permanent function (that will play a major role in the next chapter), which has no efficient classical algorithms (and is even outside of NP) under a natural conjecture. Summarizing, the power of quantum algorithms in comparison with classical ones is far from understood. While many believe they are strictly stronger, practically no one believes that they can solve NP-complete problems. In symbols:

Conjecture 11.4. BPP ( BQP

Conjecture 11.5. NP * BQP

11.1 Building a quantum computer Besides being a great theoretical achievement, Shor’s algorithm had a huge practical impact on quantum computing. Recall that factoring and discrete logarithms underlie essentially all cryptographic and e-commerce systems today, and so everyone wanted a quantum computer148. On the other hand, the power can also give rise to new types of cryptographic schemes, secure against stronger attacks. This is the subject of quantum cryptography, which we will not discuss here. Therefore, after two decades of purely academic interest in quantum computing, Shor’s paper sud- denly incentivized governments and industry to invest billions of dollars in developing a working quantum computer, with remarkable new technologies already developed that make progress in overcoming significant obstacles. One concrete (though biased) way to measure the quality of better and better technologies and designs is by the largest integer they can factor using Shor’s algorithm. Today, two decades after Shor’s paper, the largest number to be factored so far this way is 21. What are the problems with building a quantum computer? After Turing defined his Turing machine, the locality and simplicity of his design instantly suggested implementations. And despite the bulky and faulty technology at the time (this is the pre-transistor period—each bit needed its own vacuum tube!), large scale working computers were quickly built. Today the incomprehensibly fast progress of technology gives speed and memory which make us consider last year’s smartphone an archeological find. But this is all classical. The state of a classical computer is always just a sequence of bits. The same is true for probabilistic algorithms, which simply evolve a sample of the distribution describing the current probabilistic state. However, if we want interference, there is no way to sample the state of a quantum computer (e.g. by measurement) without destroying the

148We note that while a quantum computer can destroy some classical hardness assumptions for cryptography, it is not known to destroy them all (e.g. the ones based on lattice problems, such as those mentioned at the end of Section 13.8).

136 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

information. So, what is difficult is holding many bits in a complex entangled state149. This becomes even harder when this quantum state is evolving under computation. Another significant problem to overcome is decoherence noise—in quantum mechanics everything is invariably entangled with everything else, and the state of a quantum computer is affected by the outside quantum world. The important quantum error-correcting codes invented by [Sho95, ABO97, Kit03] and others150 to combat decoherence will be used, but it is not clear they suffice in practice. Diverse ingenious technologies are competing in many projects around the world to achieve this goal, and despite technological breakthroughs with other benefits, progress towards universal quantum computer still seems slow. Is there an altogether different problem preventing progress? What can it be? After all, the existence of a quantum computer is entirely consistent with the theory of quantum mechanics (and actually uses only rudimentary parts of it). Well, perhaps the theory is wrong! Perhaps quantum mechanics needs a revision to handle a very large number of entangled particles, in analogy to the revision needed in Newtonian mechanics to handle bodies moving in very fast velocities, or interacting in very high energy and minute (e.g. Plack scale) distances? Such a revision may put limits on what quantum computers can do, and may explain the slow progress above. This is a fascinating state of affairs, and it seems that regardless of the outcome, we’ll understand more! And while general purpose quantum computers are not here yet, we note that the technological progress achieved by these practical projects on quantum computational technologies yielded new ways to further Feynman’s original motivation, of efficiently simulating some quantum systems. In a different direction, such progress also yielded implementations of quantum protocols for some cryptographic problems whose properties follow from quantum mechanics and hence can resist computationally unbounded adversaries. This is in contrast to classical protocols for the same problems which need to rely on computational assumptions, and can withstand only computationally bounded adversaries.

11.2 Quantum proofs and quantum Hamiltonian complexity and dynamics We return to the mathematical arena, and conclude with a few directions in which signiﬁcant theoretical progress was made. I will not elaborate on the many advances in quantum information theory and quantum cryptography, by now very developed disciplines, with actual applications to boot (for example, the theoretical ideas of quantum teleportation [BBC+93] and of quantum key- distribution [BB84,Eke91] are becoming a reality!). I rather wish to focus on quantum complexity theory, namely the application of the methodology we have seen in action in the previous chapters of generalization, reductions and completeness. This study often happened in beautiful interaction with physicists, and with direct consequences to physics problems as well as the philosophy of science. A central notion we studied in the classical world was proof, and having a new model of eﬃcient

149Entanglement is the quantum analog of probabilistic correlation. In both classical and quantum cases there are many speciﬁc deﬁnitions, e.g. versions of entropy. Informally, just as the correlation among the bits in a probability distribution on a bit-sequence captures how far this distribution is from a product of independent distributions on individual bits, the entanglement among the qubits in a quantum state captures how far this state is from a tensor product of quantum states on the individual qubits. It should be stressed that entanglement can be far more complex, and is far less understood, than classical correlation. 150Such results often go under the name “quantum threshold theorem” to indicate that noise below a certain constant threshold per bit can be tolerated in arbitrarily long quantum computation.

137 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

computation, it is natural to extend proof (and other notions) to this setting. What is a proof in the quantum world? The most basic notion is a natural generalization of NP to the quantum setting, in which the verifier is a BQP machine, and the witness is allowed to be a (short) quantum state. The class defined by all problems which have such a verification system is called QMA151. In analogy to Cook’s and Levin’s discovery of a natural NP-complete problem, SAT , Kitaev [Kit03, KSV02] discovered a QMA-complete problem, which is natural from both computer science and physics standpoints. It can be naturally viewed as a quantum constraint satisfaction problem (CSP), analogous to 3-SAT , and moreover the local constraints arise naturally from quantum Hamiltonian physics. We note that Kitaev’s quantum reduction is quite a bit trickier than the Cook-Levin classical one, despite the syntactic similarity. The reason is that for classical states, local consistency (of the evolution of computation) implies global consistency, whereas in the quantum setting, two globally very different superpositions can look the same locally, e.g. when projected on every three qubits. Still, local consistency checks turn out to suffice, and we now explain some consequences and continuations of Kitaev’s work (details can be found e.g. in the survey [GHL14]). We start with defining the notions of a quantum Hamiltonian and of a quantum local Hamilto- nian. First, a Hamiltonian (on n qubits152) is simply a Hermitian 2n × 2n matrix H. In quantum mechanics, Hamiltonians define the dynamics of an n-body quantum system state Ψ over time t via ∂Ψ P Schrödinger’sequation i~ ∂t = HΨ. A Hamiltonian H is local if it is the sum H = i Hi where each Hi is a Hermitian matrix acting on a constant number of qubits (in the same way the local gates act in quantum algorithms). Note that each such Hi is a “local constraint”—it is essentially a constant size matrix153 and so can be described concisely: naming the indices of the qubits it acts on, and how. Many local Hamiltonians arise from quantizing statistical mechanics models of local interactions, like the Ising spin glass on a 2-dimensional lattice. A central problem in condensed matter physics is to determine its lowest eigenvalue, the ground state energy, and more generally understand its eigenvector, the ground state itself. We discuss in turn both of them, and how the computational perspective affected their study in Physics.

The complexity of ground state energy Kitaev’s result above that quantum CSP is complete for QMA is precisely about computing (or rather approximating) the ground state energy of a local Hamiltonian. Some of the important parameters of wide class of quantum CSPs are the geometry (which subsets of variables interact), locality (the maximum size of such subsets) and dimension (the number of values each qudit can take in the Hi’s). For example, Kitaev’s is a 5-local CSP of dimension 2. Physicists have studied numerous quantum CSPs arising in a variety of natural settings for decades. But the computational lens had a significant impact on the way they are studied. To understand why and how, observe first that any classical CSP (like 3-SAT ) can be viewed as a quantum CSP. This suggests that the web of reductions and completeness results we have in the classical setting can be extended to the quantum world, allowing an understanding of the relative complexity of this minimum energy problem for various quantum CSPs (and revealing, like optimization problems in the classical setting, many surprising connections). Such reductions, often between Hamiltonians from physically very different quantum systems, gave birth to the field of Quantum Simulations [CZ12], which allows studying one quantum system using another via such reductions. A large sequence of papers determined precisely the complexity of finding the ground state energy of many physically important Hamiltonians, and how it depends on the parameters of

151It would seem that QN P is a better name, but there is a reason for this notation that we do not explain here. 152Or more generally qudits, which can take more than 2 values. 153Which is formally tensored with a huge identity matrix trivially acting on the remaining qubits.

138 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

the Hamiltonian. This study has led to a rather complete characterization of the algorithmic diﬃ- culty of quantum CSPs in many cases. One very general result (see [CM13], completed by [BH14]) of this type determined the complexity of all CSPs of dimension 2 (namely, on qubits). As it turns out, these can be either in P, NP-complete, QMA-complete or “Ising-complete”. This yields a quantum analog of the dichotomy theorem discussed in Section4 for classical CSPs. Naturally, approximation algorithms and hardness were studied as well.

The ground state, entanglement, area law and tensor networks Now we turn to the understanding and computing the ground state itself of a local Hamiltonian. First let us ponder: what does the problem even mean? After all, as discussed, for a system of n qubits this is a vector in 2n dimensions (let alone with complex coefficients). So, to be efficient, we can only hope to compute some succinct representation of the ground state (or an approximation of it), assuming one exists. Such succinct representations, which allow in particular the computation of local observables (e.g. the energy of the state) were suggested by physicists, with the primary one being so-called tensor networks. Without describing them formally (see Orús’friendly physics survey here [Orú14]), they may be viewed as computational devices (like circuits) in that they “compute” the ground state much as circuits compute Boolean functions. In both cases the obvious description of these objects has length exponential in n, but for some ground states, as for some functions, the computational description may be much more succinct, e.g. polynomial in n. As in computational complexity, understanding which local Hamiltonians possess such descriptions, and furthermore, finding these efficiently from the description of the Hamiltonians, are central questions. An efficient tensor network necessarily restricts the entanglement in the state it represents; its geometry implies that certain subsets of the particles cannot be too entangled with other subsets. So an even more basic question is, which Hamiltonians have ground states with such limited entanglement structure? It stands to reason that the geometry of the local interactions of the Hamiltonian affects the structure of these quantum correlations (and may inform the construction of the tensor network). A major conjecture, called the area law conjecture, asserts that for any gapped system154, the entanglement of the ground state between any two sets of particles in the system is proportional to the area (or, graph theoretically, the cut size) of the local interaction graph between the parts. Thus, in 1-dimensional systems, where qubits reside on a line, and all interactions are between neighboring points on this path of particles, entanglement should be bounded by a constant. In 2-dimensional systems (e.g. where n qubits reside on the vertices√ of a plane lattice, or more generally on the vertices of any planar graph) it should scale like n. If we have an arbitrary graph of interactions, the area is measured by the number of edges crossing the relevant cut between the two parts, which by the area law conjecture bounds the entanglement between them. The general area law conjecture is wide open, but there are exciting developments and interactions that we briefly relate now. First, let us discuss the existence of small tensor networks, and then move to finding them. An important result of Hastings [Has07] is proving the area law for 1-dimensional systems. Further work [AAVL11], using some computational methods developed for a quantum analog of the PCP theorem (see Section 10.3), provided an exponential improvement to Hastings’ bound155. As it

154“Gapped” means that there is a constant spectral gap between the ground and the 2nd lowest energy levels of P the Hamiltonian H = i Hi, when each local term Hi in it is normalized to have at most unit norm. This is a diﬀerent regime than the QMA-complete problems, where the gap is typically inverse polynomially small. 155The conjecture is wide open for 2-dimensional lattices. A very nice, seemingly much simpler challenge is to extend this constant upper bound on entanglement from paths to trees, where all cuts are still of size 1.

139 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

turns out, Hastings’ result implies the existence of a small (polynomial size) tensor network (which for 1-dimensional systems is called a Matrix Product State). This raises the question of finding such a description efficiently. Indeed, this important question was considered much earlier, and several heuristic algorithms were developed, of which the most popular is the Density Matrix Renormalization Group (DMRG), developed by White [Whi92]. DMRG and its variants are an extremely useful heuristic for many naturally occurring and studied physical many body systems, but no theoretical explanation or provable bounds on their performance exist156. A sequence of papers using a variety of computational techniques culminated in [LVV13], which developed a completely different, provably polynomial-time algorithm, which constructs a matrix product state approximating the ground state of every gapped 1-dimensional Hamiltonian!

Hamiltonian dynamics and adiabatic computation We conclude with a short discussion of quantum Hamiltonian dynamics, as in Schrödinger’sequation. It turns out that this dynamics suggests a new way to do quantum computing, suggested by [FGGS00], called adiabatic computation. It is based on the Adiabatic Theorem of Born and Fock [BF28], one of the early and basic results in quantum mechanics. We give a high level description of adiabatic computation, specifically to contrast it with our description of how a quantum Turing machine computes. By Kitaev’s completeness result, essentially any problem we want to solve can be encoded as finding the ground state energy of a given local Hamiltonian, say on n bits (for simplicity you can consider the Hamiltonian encoding an instance of SAT ). Call this Hamiltonian H(1). Next, “prepare” some simple local Hamiltonian on n bits, and initialize it to its ground state. Call it H(0). Finally, let H(t) describe an evolution of H(0) to H(1), which can be any continuous interpolation between the two. The adiabatic theorem ensures that if this deformation is “slow enough”, H(t) will stay at its ground state throughout the process, and so we will end up with the ground state of H(1)! This would solve our original problem (e.g. will give a satisfying assignment of the encoded SAT formula). The cleverness of such a design is in picking the initial H(0) and the evolution path H(t) so that the ground state energies e(t) of all Hamiltonians H(t) are well separated from the next higher energy level, say by some γ > 0. By the adiabatic theorem, it suffices that evolution speed is slow enough that t moves from 0 to 1 in time 1/γ2. Can SAT be solved in polynomial time by this model? Can integer factoring? The first remarkable thing to observe is that quantum mechanics offers many ways to compute, which look very different from each other. The next remarkable finding is a theorem of [AvDK+08], showing that the two computational models are equivalent157! Theorem 11.6 [AvDK+08] Adiabatic computation and quantum circuits can simulate each other efficiently. As in the early days of classical computing theory, where many different types of computational models (1-tape Turing machines, multi-tape Turing machines, Lambda calculus, Random Access machines, cellular automata etc.) were found to be equivalent, the theorem above gives confidence in having the right computational model in the quantum setting as well. Indeed, yet another very different but polynomially equivalent universal model is the topological quantum computer proposed by Freedman, Kitaev, Larsen and Wang [FKLW03] where logical gates made of quantum braids act

156This may be likened to the success of the Simplex Method for linear programming on many practically arising systems of linear inequalities. And like that story, where eventually a completely diﬀerent algorithm (the Ellipsoid Method) was found to solve Linear Programming on all instances in polynomial time, here too there was a (theoretical) happy ending. 157A very elegant linear algebra proof of this theorem is due to Spielman and Read, and is as yet unpublished.

140 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

on 2-dimensional quasiparticles called anyons158. This topological model possesses strong fault- tolerant properties, and serves as a basis for some of the practical projects for building a quantum computer.

11.3 Quantum interactive proofs and testing Quantum Mechanics Just as one can generalize written NP-proofs, one can attempt to generalize the interactive proofs we discussed in Section 10.1, and study their power. A variety of analogs of the interactive proof systems were defined, yielding new characterizations of these classes in terms of classical complexity classes and analog theorems to classical ones (see e.g. [IV12, BFK10, JJUW10, BJSW16])159. But one of the most intriguing developments regarding interactive proofs was in studying the following “mixed” proof system. The prover in this system is not arbitrarily powerful (as e.g. in IP), but rather is an efficient quantum algorithm (namely in BQP). The verifier in this system is a classical algorithm (namely in BPP). Let us discuss the fundamental motivation for such mixed proof systems. Is quantum mechanics a falsifiable scientific theory? This basic question should be asked of any theory, and the general scientific paradigm for studying it, sometimes called “predict and experiment”. Any theory predicts the outcome of certain experiments or observations. When the observations match prediction, we further validate the theory. If they don’t, the theory is wrong and needs revision. Quantum mechanics, being so paradoxical and counterintuitive, has generated a host of suggested experiments and actually withstood many. Einstein, who refused to believe it all his life, devised many such experiments, of which perhaps the most famous is the EPR “paradox” [EPR35] proposed by Einstein, Podolsky and Rosen in 1935. They challenged the possibility, suggested by quantum mechanics, that quantum information is apparently maintained and communicated instantly, faster than the speed of light. In the 1960s, Bell’s famous inequalities [Bel64] suggested a concrete experiment (simplified by [CHSH69]) to refute the “local hidden variable” interpretation of quantum mechanics. Such experiments were successfully conducted starting in the 1980s (see [Asp99]), in some sense certifying that quantum mechanics is indeed paradoxical and counterintuitive, or at least defies simple classical probabilistic explanations. And while quantum mechanics is completely accepted and used to great technological impact, philosophical arguments about its interpretation persist today. As mentioned above, the possibility of large scale, general purpose quantum computing is a real challenge on how complete this theory is. How can one test this? Well, if indeed quantum algorithms can be exponentially faster for some problems than classical algorithms, then every such algorithm suggests a new experiment to conduct, and with it, a real dilemma. Take any function which possesses a fast quantum algorithm but no classical one. The prediction to test is simply that the given quantum algorithm computes the correct answer (on some input). The dilemma is how to test this fact by efficient classical means, for which the correct answer is, by assumption, impossible to obtain! This is no mere philosophical problem! It may become a real issue if and when one of the multiple projects attempting to build quantum computers will claim success (as do already some companies who sell computers allegedly using quantum algorithms). How do we test such claims? Of course, for some problems a purported quantum algorithm can be efficiently tested classically. For example, Shor’s factoring algorithm is easily verifiable, as it

158Fear not—I too don’t understand the last sentence. 159We do not have as yet a satisfactory analog of the PCP theorem 10.6 (see [AAVL11] for the (subtle) formal deﬁnitions and some initial results—far more has happened since).

141 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

produces the factors, which a classical verifier can multiply back and check. More generally, such classical testing can be done for any function in N P ∩coNP, if the quantum algorithm produces the necessary witness. But BQP potentially contains much harder problems, e.g. outside of NP. How can we test quantum algorithms (or devices) purporting to solve these problems? A new idea, put forth independently in [BFK09, ABOE10] (see full proofs and historical survey in [ABOEM17]), is to allow interactive experiments, in the spirit of interactive proofs (of Section 10.1). Namely, assume that a BQP-algorithm can solve some problem, can (possibly another) BQP algorithm interact with a classical BPP algorithm and convince it (with high probability) of that it solves this problem correctly? Can such interactive verification be done for all problems in BQP?[ABOE10] prove that the answer is essentially ‘yes’160! We note that this basic, natural idea, of testing scientific theories via interactive procedures is potentially powerful in other settings as well.

11.4 Quantum randomness: certification and expansion One of the most personally satisfying developments in the interaction between computational complexity and quantum mechanics has been the recent flurry of papers on certification and expansion of randomness, which connects several important notions discussed in this book. I have given many lectures on pseudo-random generators and randomness extractors, the topics of chapters7 and9, to varied audiences. Recall that (on top of many theoretical side benefits) these two theories (respectively) explain how we can salvage the amazing utility of perfect randomness (namely, of independent, unbiased coin flips) in worlds that don’t have it; either a completely deterministic world providing no randomness at all, or alternatively in a world where randomness is very defec- tive (some entropy is there somewhere, but the “coin flips” it supplies are arbitrarily biased and correlated). In lectures on this subject, the most typical question I get from physics-minded audience members is: “Why bother worrying about such hypothetical worlds? In our world quantum mechanics suggests simple devices producing a stream of perfect random bits. Don’t you trust quantum mechanics?” This indeed is an excellent question, with an excellent answer, related to what we have just discussed above: “Even if I do trust the theory, why should I trust the devices?” The basic question here is, how can you test that a given distribution is random? Let us be more precise about the setting. Suppose that some black box, B (operated by your worst enemy), is spewing out a stream of bits, say n of them. You would like to design a test (i.e. a function) that will output YES/NO, that will distinguish the cases where e.g. the output is random (say, has positive entropy rate) from the output being deterministic (namely is a fixed sequence). Clearly, if no assumptions are made about B, this is impossible. By convexity, if any distribution causes an output YES with some probability p, some fixed sequence in the support of this distribution will do at least as well (and our enemy may choose to output this sequence). The same argument remains true if our test is more complex, e.g. we are allowed to feed B with some (possibly random) input, on which B’s output may depend. So, we need to assume something about the way B operates161. The new discovery we relate here is that a most natural physical assumption, indeed far weaker than full-fledged quantum mechanics, suffices. This (classical!) assumption is called no-signaling. It assumes that B actually consists

160Currently the veriﬁer in these proof systems is not quite classical, but nearly so—the best known one uses only a register containing a single qubit [Bro15] 161The so-called “no free lunch” theorem says that we must always pay (with assumptions) for what we get. Indeed, for the two theories of randomness above, postulated (respectively) computational assumptions for pseudo- randomness in a world with no randomness, and the availability of (very few) truly random bits for randomness extractors in a world with “weak” randomness.

142 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

of two boxes, B1 and B2 which do not communicate in the following strong sense: the output distribution of each is independent of the input to the other162163 . Enforcing no-signaling between devices is in principle possible by appropriate spacial separation, and we will assume it. So, we will attempt to extract certified randomness from (say two) no-signaling boxes by means of a “game”. The key will be the set of “strategies” these no-signaling boxes can implement. The power of quantum over classical strategies in the no-signaling setting was key to the Bell inequalities and their simplification by [CHSH69] mentioned above with regard to the EPR paradox and the hidden-variable theory. Indeed, this power is beautifully demonstrated by the original CHSH-game of [CHSH69], which we now describe. Imagine that a verifier sends independent unbiased bits x1 and x2 respectively to B1 and B2, who respond respectively with bits y1, y2. Say that the boxes “win” the game if x1 ∧ x2 = y1 ⊕ y2, an event the verifier can easily check. What is the maximum probability the boxes win if their strategy must be no-signaling? It is a simple exercise to check that if their strategies are classical (namely, each outputs a probability distribution depending on its input), then the optimal strategy yields a win with probability .75. In contrast, no-signaling is such a weak requirement that it affords the boxes a simple joint strategy (that the reader is invited to find) which wins with probability 1. What is striking is that it is not too hard to design quantum strategies (namely, when the boxes share an entangled pair of qubits), easily implementable by very simple quantum devices, that allows the boxes to win with probability cos2(π/8) ≈ .853 ... (which incidentally happens to be optimal for quantum strategies by the Tsirelson bound [Tsi93]). This gap between classical and quantum power arising from the Bell inequalities (as in particular this game reveals) served for decades as a demonstration of how counterintuitive (and potentially incomplete) quantum mechanics is, how the local hidden variable theory fails to explain it, how the non-commutative probability theory arising from quantum mechanics differs from the commutative one of classical mechanics, etc. etc., all central to our understanding of this fascinating world in which we actually live. And then Colbeck, in his 2006 PhD thesis [Col06] found another fundamental aspect that such a classical-quantum gap as in this game demonstrates. He made the following observation. If you are repeatedly playing the CHSH-game against no-signaling boxes, and they are winning consistently with higher probability than 75%, their output must contain entropy (beyond what is supplied by their inputs)! To see this, note that otherwise they are using deterministic strategies, which are in particular classical. So, the boxes don’t have to be trusted: we can test the statistics of winning over a large number of experiments, and if (say) it exceeds 80% we accept them as producing randomness (otherwise declaring them faulty). In short, randomness can be certified; this is one remarkable insight! Now you might start complaining that we wanted a stream of independent, unbiased bits and we are barely getting fractional entropy at best. You might also complain that we have to put in more (and perfect) randomness than we get out, and wonder about the point of the whole exercise. But then, for both issues, you remember the contents of Chapter9 on randomness extractors and see the light. Indeed, all this was done, in a rapid succession of papers starting with Pironio et

162A similar deﬁnition exists for more than two boxes, which will be needed later. Basically, the joint output distribution of any subset of boxes is independent of the joint inputs to the rest. 163As an aside, we note that this notion was used in a recent classical result, providing another demonstration of the power of “quantum ideas” in the classical setting. The reader may recall that no communication between provers was essential to the multi-prover system MIP of [BOGKW89] mentioned brieﬂy in Chapter 10 as a precursor to PCPs. The new powerful PCP theorem of [KRR14] for no-signaling provers allows ultra-fast, trusted delegation of computation to powerful entities. Other examples of the power of “quantum ideas” in classical settings can be found in the survey [DdW09].

143 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

al. [PAM+10], showing that few perfect random bits can be expanded into many, nearly uniform ones. The latest available results [MS14a, CY14] achieve the best one can hope for: an unbounded expansion with minimal error! More precisely, a fixed constant number of no-signaling boxes can certifiably generate, with an input seed of k truly random bits, a distribution on any number n of output bits, which is exp(−k) close to the uniform distribution on n bits. These constructions and proofs are quite complex, and we only make a few comments about them. First, different parts of the seed will have different functions. One is hiding from the boxes which subset of the many CHSH games played will be used to generate the output. The second is a normal seed to a randomness extractor, used to convert the present entropy in these outputs into a uniform distribution. Another important point is that in this process the boxes are reused again and again for further and further expansion or randomness, using old outputs as new inputs. So it seems like potentially the boxes can use their memory and shared entanglement to generate correlations in the final output. Preventing this is subtle and requires new delicate techniques of quantum information theory. Finally, this new ability of certified randomness has at least one important use in quantum cryptography, namely for “device-independent” security of quantum key-distribution [MS14a].

144 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

12 Arithmetic complexity

We now leave the Boolean domain, and discuss instead the computation of polynomials over arbitrary fields. Polynomials, being so basic and so useful, are studied in a variety of mathematical areas. Here we study their complexity: how many arithmetic operations are required to compute natural ones (e.g. the elementary symmetric polynomials, determinant, permanent, matrix multiplication, convolution, etc.). This study is clearly natural from mathematical and practical standpoints. But once the computational complexity machinery of reductions and completeness is applied, it leads to analogs of P vs. NP and other complexity questions which seem easier to solve than in the Boolean world. There are several reasons for this. Computing formal polynomials is strictly stronger than computing the functions they define, there are fewer relations than in the Boolean world (e.g. x2 = x) which restricts the power of arithmetic computation, and finally, more mathematical tools, mainly from algebra, are available. Indeed, progress on arithmetic circuit complexity is faster-paced in comparison to Boolean circuit complexity, with exciting new developments. For this reason, even the recent surveys [SY10,CKW11] are not completely up to date (but do provide detail and proofs for most of the material here and more). Extensive books with scope much wider than we discuss here are [BCS10, vzGG13]. In this section we use the same164 notation S(f) to denote the minimal size of an arithmetic circuit computing a polynomial f. We will formally define it below in general for multivariate polynomials. But for starters let us discover the difficulty, depth and unexpected connections of such questions even for univariate polynomials.

12.1 Motivation: univariate polynomials

Consider f(x) ∈ F[x] of degree d. How many additions and multiplications does it take to compute f (starting from x and any constants from F)? Even this simple question is nontrivial. One clever upper bound is Horner’s rule, which gives S(f) = O(d) (try proving it, or peek at the 165 footnote ). Another√ nontrivial fact is an existential lower bound, showing that some polynomials require S(f) = Ω( d). But some polynomials are much faster to compute. For example, consider g(x) = xd. Clearly, S(g) = O(log d), as we can compute the successive powers x, x2, x4, x8,... and then multiply the necessary subset to get xd. Also, it is also obvious that S(g) = Ω(log d), indeed at least log d multiplications are necessary. Amazingly, the following is open. Open Problem 12.1. Describe a degree d polynomial f for which S(f) 6= O(log d). One natural guess is that the g above is easy because it has multiple roots. Consider instead the polynomial h(x) = (x − 1)(x − 2) ··· (x − d) which has d distinct roots. What is its complexity, over the Rationals Q? Besides the obvious log d ≤ S(h) ≤ d, nothing is known. But strong upper bounds have an amazing consequence—that factoring integers is easy! Hint: this connection was dubbed “factorials vs. factoring”. This and more general results are described by Lipton in [Lip94], with some of the ideas dating back to Shamir [Sha79a]. Theorem 12.2 [Sha79a, Lip94] If S(h) ≤ (log d)O(1) then Integer Factoring is in P/poly.

164As for Boolean circuits. 165 Any degree d polynomial can be written as a0 + x(a1 + x(a2 + x(··· + x(ad)))), involving d additions and d multiplications

145 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

12.2 Basic deﬁnitions, questions and results

We will consider polynomials in F[x1, x2,... ]. The definitions and most questions are interesting over any field F. However some of the results hold only for certain fields, which for this theory are “large enough”, or more specifically have characteristic zero or are algebraically closed. On the other hand, almost all polynomials we’ll discuss will have 0/1-coefficients, so they make sense over any field. For concreteness the reader may think that F = C or F = Q. There are many parallels and differences between Boolean and algebraic circuit complexity, and the reader may want to be reminded of the Section 5.2. We start by defining size. Just as in Boolean circuits, an arithmetic circuit (over F) is a directed acyclic graph in which the non-input gates are labeled with the arithmetic operations + or ×. Namely each gate outputs the polynomial which is respectively the sum or product of its two input polynomials. The input nodes can be labeled with the variables xi, as well as with any constants from F. Thus e.g. the polynomial πx + y can be computed with a circuit having 3 inputs, one multiplication gate and one addition gate. The size of a circuit is simply the number of wires in its graph. An arithmetic formula is a circuit whose graph is a tree. Allowing the use of constants explains why we don’t need a special gate for subtraction. We will soon discuss division as well. Clearly, every polynomial f ∈ F[x1, x2,... ] can be computed by a circuit (and a formula). We denoted by S(f) the minimal size of a circuit for f, and by L(f) the minimal formula size. We clearly have S(f) ≤ L(f). Note that we view arithmetic circuits as computing formal polynomials, as opposed to the functions they define. This is a distinction over finite fields, e.g. the formal p polynomials x and x are distinct, despite being equivalent as functions over Fp, and so while the size complexity of the first is constant, the second requires size ≥ log p. Like Boolean circuit complexity, arithmetic circuit complexity is an asymptotic theory. We will typically have a sequence f = {fn} of polynomials parameterized by n, which will typically be the number of variables or a polynomially related quantity. For example, the determinant polynomial 2 will be a sequence DET = {DETn} where DETn(X) is the determinant polynomial in n variables xi,j of the n × n matrix X. It is important to note that, unlike the Boolean setting, a polynomial has another input parameter which the complexity may depend on, namely its degree. Almost the whole theory deals with multivariate polynomials, and to focus on a single parameter we will insist that the (total) degree of fn is at most a fixed polynomial in n as well. In fact, this will hardly be a restriction, as most of our polynomials will be multilinear, namely in which every variable appears in every monomial with degree at most 1, so the total degree will be automatically bounded by the number of variables. Arithmetic lower bounds are hard to prove. Indeed, consider even the arithmetic analog of Shannon’s theorem 5.6, which proves the existence of Boolean functions which require exponential size circuits. Recall that it used a counting argument—there were simply more functions than small circuits. However, in arithmetic circuits over an infinite field F, even though the number of “skeleta” of arithmetic circuits is finite, their ability to use arbitrary constants from F makes their number infinite. Sure, the number of coefficients of monomials of our potentially hard polynomials can also be chosen in infinitely many ways, but we promised to consider only polynomials with 0/1 coefficients, of which (bounding the number of variables and degree) there are only finitely many. Nevertheless, Hrube˘sand Yehudayoff [HY11] proved. Theorem 12.3 [HY11] For every field F, almost all multilinear polynomials f on n variables166 with 0/1 coefficients require S(f) ≥ 2n/10.

166And so of degree ≤ n.

146 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

The proof (which gives a more general result) replaces the counting argument with a “dimension argument”, and appeals to basic algebraic geometry. Indeed, not surprisingly, such tools as Bezout’s theorem and algebraic transcendence arguments are crucial in this algebraic setting, and are used also for the few explicit lower bounds we know. We will discuss these in the next subsection, but the highlights are explicit multilinear polynomials f, g on n variables requiring S(f) ≥ n log n and L(g) ≥ n2/ log n. Thus in particular, in the arithmetic setting we do have (slightly) super-linear circuits size lower bounds, for polynomials of degree that grows with the number of variables. Here is one challenging open problem, for which these algebraic geometric tools above seem insufficient. Open Problem 12.4. Find explicit constant-degree n-variate polynomials f for which S(f) 6= O(n) The final basic aspect we touch on is the relative power of circuits and formulae. Recall that in the Boolean setting we believe that circuits are exponentially stronger than formulae. In arithmetic circuits they are much closer in power. An important result of Valiant, Skyum, Berkowitz and Rackoff [VSBR83] shows that arithmetic circuits are amenable to so-called “depth reduction”. Namely, every circuit computing a degree d polynomial can be “squashed” to have only O(log d) alternations between addition and multiplication gates, without significantly increasing its size! For polynomials we care about, namely with d = nO(1), formula size is at most quasi-polynomial in circuit size. We state only the corollary to formula size, proved earlier by Hyafil [Hya79]. Theorem 12.5 [Hya79] Let f be a polynomial of degree d. Then L(f) ≤ S(f)O(log d).

12.3 The complexity of basic polynomials Let us discuss some basic examples of polynomials and what we know about their complexity.

Symmetric polynomials One important class of polynomials is the elementary symmetric polynomials, deﬁned by

k X Y SYMn(x1, x2, . . . , xn) = xi S⊂[n]:|S|=k i∈S for all 0 ≤ k ≤ n. What is the best way to compute them? Writing them as “sum of products” will take (e.g. for k = n/2) exponential size. It turns out that allowing instead “sum of product of sums” a beautiful observation of Ben-Or [BO85] on the power of polynomial interpolation, results in exponential savings, even for formulas! k 2 Theorem 12.6 [BO85] For all n and k, L(SYMn) ≤ O(n ). The simple proof arises from noticing that (multivariate) symmetric polynomials in the n vari- Qn ables xi are the coefficients of the (univariate) polynomial g(t) = i=1(t + xi) in a new variable t. The formula thus evaluates g the n+1 distinct values for t (each is a product of sums), and then uses interpolation (which is a linear combination converting values of a polynomial to its coefficients) to compute the desired coefficient from these evaluations. Note that this works only over sufficiently large fields; indeed, we know that over small fields such depth-3 (or indeed any bounded depth) circuits require exponential size. Such circuits (or formulas) as above, with three alternations between sums and products, are

147 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

called ΣΠΣ-circuits167. As it happens, for such depth-3 formulas this quadratic upper bound is tight [SW01] over all ﬁelds. Suppose we remove the depth restriction, allowing general formulas or circuits, can we then hope to compute the symmetric polynomials in linear size? This possibility was ruled out in a beautiful combination of two papers, of Strassen and Baur-Strassen [Str73a, BS83], again using basic algebraic geometry that we sketch below. It provides the best explicit circuit lower bound we know, and was not beaten for 40 years! n/2 Theorem 12.7 [Str73a, BS83] For all n, S(SYMn ) = Ω(n log n). The ideas of this proof are more easily explained for a much simpler family of symmetric polynomials, the traces (or power sums), so we turn to discuss them. Let

n d X d Tn (x1, x2, . . . , xn) = xi . i=1 The same authors proved d+1 Theorem 12.8 [Str73a, BS83] For all n, d, S(Tn ) = Ω(n log d). As we turn to explain the ideas of this proof in some detail, some readers may want to skip ahead at first reading, and proceed to the next topic of Matrix Multiplication. The proof of this theorem follows immediately by combining the two theorems below, which highlight different nontrivial ways in which arithmetic circuits can compute more efficiently than might be expected, unveiling power that may explain why lower bounds are hard to prove. We need to extend our notation of circuit size measure in the obvious way to circuits with several outputs, which compute several polynomials, denoting it by S(f1, f2, . . . , fm). The first theorem states that task of computing a sum of powers is not much easier than the task of computing each of the powers separately, and the second theorem proves the lower bound for that latter task.

d d d d+1 Theorem 12.9. For all n, d, S(x1, x2, . . . , xn) ≤ O(S(Tn )). d d d Theorem 12.10. For all n, d, S(x1, x2, . . . , xn) = Ω(n log d). Each of these theorems is a special case of a more general one, and we explain them in turn. For the first, Baur and Strassen [BS83] gave a general reduction (greatly simplified by Moregenstern in [Mor85]), from computing the gradient168 ∇f of a polynomial f to computing the polynomial itself. This is one of the nicest examples where an important algorithm is invented in order to prove a lower bound. Needless to say, computing the gradient of a multivariate function is a basic subroutine in optimization, when performing any of the many variants of gradient descent algorithm. As it turns out, an even more general theorem was discovered earlier in the statistical learning community by Werbos [Wer74, Wer94], and is an important learning procedure which in that literature is called back propagation. Theorem 12.11 [BS83, Wer74] For every polynomial f on any number n of variables, S(∇f) ≤ O(S(f)). This is a pretty surprising theorem, as the most obvious way to compute the first partials is one at a time, resulting in a factor n loss in size. But it turns out that computing these can be

167The usual representation of a polynomial as a sum of monomials is a ΣΠ-circuit, and we will later discuss the importance of ΣΠΣΠ-circuits. 168Namely the vector of ﬁrst partial derivatives of f, ∇f = ( ∂ f, ∂ f, . . . , ∂ f). ∂x1 ∂x2 ∂xn

148 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

combined cleverly in a way that loses only a constant factor in size. Before sketching the proof, note that it implies Theorem 12.9 by noting that ∂ T d+1 = xd. ∂xi n i To give a high level hint of the proof of Theorem 12.11 (following Morgenstern’s beautiful argument [Mor85]), imagine that the gates of the circuit for f compute (in order) the polynomials g1, g2, . . . , gs, where the first n gi are the variables xi, and the last one is gs = f. Append to this circuit its “mirror image”, namely gates hs, . . . , h2, h1 that will (using the chain rule for partial derivatives of multivariate functions) compute (in this order) hi = ∂f/∂gi using the children of gi in the original circuit. d Now let us turn to Theorem 12.10. It looks obvious. After all, computing each output xi requires log d multiplications as we saw in the previous section, and surely these n computations cannot be combined, as they involved different variables. Thus we must pay a factor n times the cost of a single task, giving the required n log d lower bound. Convinced? Like many arguments containing words like “surely” (or “it is easy to see” etc.), the above argument is false, and the bug is precisely in this arrogant word. We will soon see an example where n different computations on completely disjoint variables can be non-trivially combined, with a sublinear size increase of only a factor nc more than a a single task, with c < 1. In other words, sometimes a surprising economy of scale is possible in arithmetic computation, which rules out this type of argument169. So another route must be taken to show that for the problem at hand no economy of scale is possible. Strassen [Str73b] proved the following general degree lower bound.

Theorem 12.12 [Str73b] For any set of polynomial f1, f2, . . . , fm on a set variables x1, x2, . . . , xn we have S(f1, f2, . . . , fm) ≥ log deg(f1, f2, . . . , fm).

Here, deg(f1, f2, . . . , fm) extends the usual notion of degree of a single polynomial. It denotes the degree of the algebraic variety defined by the polynomials f1 − z1, f2 − z2, . . . , fm − zm) (with the zi new variables disjoint from the xj), and we will not define it formally here. But the role it plays in this proof is easy to understand in analogy of this theorem with the trivial univariate case, that already gave us a lower bound of S(g) ≥ log deg(g). This univariate lower bound followed from the basic facts about degree, namely that (a) addition does not increase the maximum degree of the two polynomials it adds, and (b) that multiplication at most doubles that maximum degree. As it happens, both (a) and (b) are satisfied also in the multivariate case, with that notion of degree; this is guaranteed by a basic algebraic geometric fact called Bézout’stheorem. Using this, Strassen’s multivariate theorem follows as the univariate one. To conclude from it Theorem 12.10, it suffices n to check that indeed deg(f1, f2, . . . , fm) ≥ d , which turns out to follow from the simple fact that n the system of polynomial equations {fi = 1} has d solutions in C.

Matrix multiplication

Consider next matrix multiplication MM, where MMn(X,Y ) takes two n × n matrices X,Y and outputs their product XY . Formally this is a polynomial map as here we compute the n2 entries of the product, and we consider circuits with so many outputs. The obvious algorithm, performing each inner product separately, gives S(MM) = O(n3), which was considered best possible for centuries. Strassen [Str69] shocked the mathematics community proving a sub-cubic bound,

169This question, of achieving economy of scale by combining computations of many independent instances of the same problem, is relevant to any computational model. It is called the direct-sum question, and is understood only for precious few models.

149 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

S(MM) = O(nlog2 7) = O(n2.8074...). With hindsight, you can figure it out yourself: try to devise a method to multiply two 2 × 2 matrices using only 7 multiplications (and any number of additions). If you succeed, and furthermore you did not use commutativity of the matrix entries, then you can use recursion for multiplying larger matrices (and check that multiplications dominate the total complexity). One consequence of this sub-cubic algorithm is to the direct-sum (economy-of-scale) problem mentioned earlier, showing how arithmetic circuits can achieve nontrivial savings when performing independent tasks jointly. To see this, note that the product XY of two n × n matrices may be viewed as n instances of a matrix-vector products, where we fix the matrix X, and let the column vectors of Y be the independent variables. For a typical fixed matrix X, the task of multiplying it by one vector takes n2 operations. Strassen’s fast matrix multiplication algorithm magically combines the computation of n independent such tasks, paying a factor far smaller than n in size. This algorithmic breakthrough generated a very long sequence of improvements to the exponent, and the current record is S(MM) = O(n2.3728639...). The rich variety of ideas in this history is surveyed in the PhD thesis of Stothers [Sto10]. The obvious question is how far down will the exponent drop — can it get down to 2?

Open Problem 12.13. Prove or disprove: For every > 0, S(MM) = O(n2+). The main line of work, responsible for most progress and leading to the current record, comprises of variants and extensions of Strassen’s laser method. But as you might guess from the number of digits in the record exponent shown, recent progress has been to further and further digits, using heavy computer calculations. Ambainis et. al. [AFG14] formally encapsulated this set of techniques around the laser method, and proved they get stuck at n2.3078, and suggest possible changes to the method that may circumvent this lower bound. A completely diﬀerent, ingenious approach to matrix multiplication was suggested by Cohn and Umans [CU03] (and developed further in [CKSU05, CU13]). It shows how upper bounds on the exponent of matrix multiplication (potentially approaching 2) would follow directly from simple properties of (appropriate) ﬁnite groups, thus presenting a concrete challenge to group theorists: do such appropriate groups exist? I will not state here the conditions required from the group, but only note that it involves the sizes of certain subgroups and the largest dimension of its complex irreducible representations. As beautifully explained in the original paper, this approach to matrix multiplication may be viewed as a non-commutative analog of another gem of arithmetic computation: the n log n size circuit for the convolution of two n-vectors via the fast Fourier transform on the cyclic group Zn. In both cases, the required product is reduced to multiplying two elements in the group algebra of an appropriate group. In the Abelian case (of convolution), Fourier transform reduces this at once to several multiplication of constants, as all irreducible representations are of dimension 1. In the non-Abelian case (of matrix multiplication), Fourier transform reduces this to a series of smaller matrix multiplications, which sizes depend on the dimensions of the irreducible representations, and these are handled recursively.

The determinant Next, we consider what is perhaps the most important polynomial in mathematics, namely the determinant polynomial DET , deﬁned by the familiar formula (where Sn denotes the symmetric

150 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

group of permutations on [n]):

n X Y DETn(X) = sgn(σ) xi,σ(i).

σ∈Sn i=1 Again, here is another polynomial with exponentially many monomials, which we knew for centuries has an eﬃcient algorithm for computing it: Gaussian170 elimination gives S(DET ) = O(n3). Actually, does it? Recall that Gauss elimination essentially uses division, which we do not allow in our arithmetic circuits. Can division help when computing polynomials? Strassen [Str73b] showed that, up to a polynomial blow up in size, they do not! For determinant, there is no loss at all. A beautiful algorithm of Berkowitz [Ber84] actually reduces (in a sense we’ll discuss soon) the computation of determinant to computing the product of several matrices. Thus it actually proves a much stronger upper bound on circuit size. Theorem 12.14. S(DET ) ≤ O(S(MM) log n) = O(n2.3728639...). We have no superlinear circuit size lower bounds for determinant. How about formulas? The best upper and lower bounds are given below. The quasi-polynomial upper bound is due to Hyaﬁl [Hya79] (which actually inspired the Berkowitz algorithm above). The cubic lower bound is due to Kalorkoti [Kal85], who actually developed a technique for general formula lower bounds via a transcendence degree argument171. Theorem 12.15. • • L(DET ) = O(nlog n). • L(DET ) = Ω(n3).

The permanent All polynomials above can be eﬃciently computable. We end our example with the prototypical hard polynomial, the permanent. It is the “monotone” sibling of determinant, deﬁned by n X Y PERn(X) = xi,σ(i).

σ∈Sn i=1 Despite their structural similarity, determinant and permanent are worlds apart. The best known way to compute the permanent is via Ryser’s formula [Rys63], which signiﬁcantly saves on the number n! of monomials, but is still exponential. Interestingly, it is a ΣΠΣ-formula. Theorem 12.16 [Rys63] L(PER) = O(n22n). As we will soon see, the most important open problem in algebraic complexity, proving explicit super-polynomial circuit lower bounds, can be asked about the permanent. Conjecture 12.17. S(PER) 6= nO(1).

170It is named after Gauss mainly for the notation he invented. This method for solving simultaneous linear equations was used by Chinese mathematicians 2000 years ago. 171 This general technique can actually yield a near-quadratic lower bound of n2/ log n for an explicit multilinear 2 polynomial in n variables (this is a stronger result since DETn has n variables). Proving a super-quadratic lower bound for such polynomials is an important challenge!

151 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

12.4 Reductions and completeness, permanents and determinants Valiant’s paper [Val79a] transformed arithmetic complexity into a complexity theory. In it he provides the analogs of all basic foundations of Boolean computational complexity: • Gives a mathematically elegant notion of efficient reducibility between polynomials, projection. • Defines arithmetic analogs of P and NP, now called respectively VP and VNP. • Endows these classes with natural complete polynomials under such reductions: permanent is complete for VNP and determinant is (nearly) complete for VP. Let us explain all these in turn, and then discuss some consequences. We note that all definitions are non-uniform, as for Boolean circuits. We now define two, nearly equivalent, notions of reduction, Valiant’s projection and the slightly more general, mathematically standard, affine projection172. While we mainly use the latter, essentially all results hold for both.

Definition 12.18 (Projection and affine projection). Let f ∈ F[x1, x2, . . . , xn] and g ∈ F[y1, y2, . . . , ym]. n We say that f is an affine projection of g, written f ≤ g, if there exist m affine functions ì : F → F such that f(x) = g(`1(x), `2(x), . . . , `m(x)). We say that f is a projection of g if it is an affine projection where all affine functions ì depend on at most one variable. It is clear that these reductions are efficient in terms of circuit size; if f ≤ g then S(f) ≤ S(g) + O(mn), as given a circuit for g we can feed its inputs the affine functions ì to get a circuit for f. This relation is clearly transitive, and so gives a partial order on the relative complexity of polynomials, as in the Boolean world. The class VP, in complete analogy to P/poly, is simply all polynomials computable by polynomial size arithmetic circuits. We remind again that in all polynomials discussed the degree is polynomially bounded by the number of variables. Thus e.g. the polynomials SYM,MM,DET of the previous section are all in VP.

O(1) Definition 12.19 (The class VP). We say that f = {fn} is in VP if S(f) ≤ n . Defining the analog VNP of NP is a bit more complicated, but nevertheless natural. In NP an existential quantifier is used, which can be viewed a Boolean disjunction over all possible Boolean values to potential “witnesses”, or “certificates” in a polynomial size Boolean circuit. In the arithmetic VNP this disjunction is replaced by a summation over possible “witnesses” in a polynomial size arithmetic circuit (thus effectively converting computing the existence of certain objects into counting them). It is a nontrivial and important choice to still take this sum only over Boolean values, regardless of the underlying field.

Deﬁnition 12.20 (The class VNP). We say that f = {fn} ∈ F[x1, x2, . . . , xn] is in VNP if there exists g = {gn} ∈ F[x1, x2, . . . , xn, y1, y2, . . . , yn] ∈ VP such that fn(x) is deﬁned from gn(x, y) via P fn(x) = α∈{0,1}n gn(x, α) We clearly have VP ⊆ VN P, and the major problem of arithmetic complexity theory is proving Conjecture 12.21. VP 6= VNP

172We note that most polynomial-time reductions discussed for Boolean computation are actually projections, or a very simple Boolean function of a few projections.

152 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Finally, we get to the complete problems, determinant and permanent. Noting that these two polynomials are identical when the field F has characteristic 2, we now consider only fields with characteristic different than 2. Valiant proved two completeness theorems. The one for VNP is completely clean. Theorem 12.22 [Val79a] PER is VNP-hard. More precisely, for every f = {fn} ∈ VN P and every n, fn ≤ PERnO(1) . The reader is invited to verify that also PER ∈ VN P, so the theorem implies that PER is actually a complete polynomial for VNP. The completeness of determinant is a bit harder to state. First, we need to define an important subclass of VP, which we call VL, of all polynomials which have polynomial size formulae. Theorem 12.23 [Val79a] DET is VL-hard. More precisely, for every f = {fn} ∈ VL and every n, fn ≤ DETnO(1) . As DET is in VP, is hard for VL, and by Theorem 12.5 these two classes are nearly equal (up to quasi-polynomial factors), we get a precise meaning for DET -completeness in VP. Namely every polynomial f ∈ VP is a projection of an nO(log n) determinant. These completeness results, besides providing a starting point for many other reductions (as was the role SAT played in Boolean complexity), highlight the importance of these two polynomials, permanent and determinant, and may partly explain the important role they play in mathematics. First, the determinant appears everywhere in mathematics — lots of useful polynomials which naturally arise are expressible as determinants (e.g. Jacobians in calculus, Alexander polynomials in knot theory, Wronskians in differential equations, characteristic polynomials and resultants in algebra, volumes of parallelepipeds in geometry, and numerous others). We may be less surprised at this phenomena now that we know that every polynomial which can be described by a small formula has an equally small determinantal representation! Similarly, the permanent appears quite frequently as well. It turns out to capture the Tutte and chromatic polynomials in graph theory, the Jones polynomials in knot theory, and many partition functions arising in statistical mechanics models, counts integer points in convex sets, counts extensions of partially ordered sets, etc. Unlike the examples for determinants, these seem hard to compute! Another important contribution of these completeness results is that the major problem of separating VP from VNP can be cast as a question about the best projections from PER to DET . More precisely, let m(n) be the smallest integer for which PERn ≤ DETm(n). Then the completeness results imply Corollary 12.24. If VP 6= VNP then m(n) 6= nO(1). And almost conversely, If m(n) 6= nO(log n) then VP 6= VNP. Attempts to study m(n) started with Polya, who noticed173 that m(2) = 2. It may not be even clear that m(n) is always finite, but of course combining Theorems 12.23 and 12.16 we get that m(n) ≤ exp(n). The best known lower bound, due to Mignon and Rassayre [MR04] (extended by [CCL10] to all fields), is quadratic. Theorem 12.25. m(n) ≥ Ω(n2). The proof is essentially linear-algebraic, and uses only simple properties of linear projection, and of the Hessian of the determinant polynomial. Improving this quadratic bound is a major challenge.

173 x y x −y via the simple projection per ( z w ) = det z w

153 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

An ambitious program to prove super-polynomial, or even exponential lower bounds on m(n) and separate VP from VNP was suggested by Mulmuley and Sohoni (see the surveys [Mul12a, Mul11,BLMW11]). It crucially uses the fact that both the permanent and determinant polynomials are determined by their symmetries. These symmetries are subgroups of the linear groups, and the affine projection reduction is linear as well. This allows formalizing the problem of VP vs. VNP as a question about the intersection of the algebraic varieties defined by the orbit closures (under their natural symmetry groups) of the determinant and permanent polynomials . This formulation naturally suggests using tools from invariant theory, representation theory and algebraic geometry (some more details are provided in Section 13.9). There seem to be severe obstacles to this program so far (see e.g. [BIP16]), but this focus on using symmetry, and the tools developed, may serve to understand (and perhaps prove new lower bounds) for other problems in arithmetic complexity. Finally, we note that separating VP vs. VNP may be achieved in a completely different way, from an efficient deterministic algorithm for a problem in Boolean complexity about arithmetic complexity. This direction is a major bridge between these two fields, and ties the two to pseudorandomness and derandomization. The problem is the Polynomial Identity Testing problem (or PIT for short). It asks if a given arithmetic formula computes the identically zero polynomial. Almost equivalently (due to Theorem 12.23), in its original form asked by Edmonds [Edm67], the same question asks to decide if the determinant of a given symbolic matrix (whose entries are linear forms in some variables), vanishes identically. This problem has a simple efficient probabilistic algorithm (discussed in the beginning of Section 7.1), but the best known deterministic algorithm for it requires exponential time. Surprisingly, Kabanets and Impagliazzo [KI04] proved that significant improvement of the deterministic complexity (namely, non-trivial derandomization) will entail explicit lower bounds on either arithmetic or Boolean complexity. More on the PIT problem, and partial progress on it and its relatives, can be found in Section 4 of the survey [SY10]. More recent progress from a very different direction can be found in [GGOW15].

12.5 Restricted models As for Boolean circuits, our inability to prove strong lower bounds for the general model invites the study of restricted ones, often of interest in their own right. We describe some of them where super-polynomial lower bounds are known, but moreover some substantial challenges remain despite their restricted nature. We note that a similar eﬀort, which we described in less detail in previous chapters, happens of course also for Boolean circuits, proof complexity and a variety of other computational settings. In all we are (hopefully) inching our way into truly general lower bounds through the development of new techniques, and testing our mettle, by proving lower bounds on a variety of restricted computational models.

Monotone circuits Monotone circuits make sense for ordered fields like R or Q. They are defined just as general circuits, except that they can only use positive coefficients from the field. Monotone circuits can clearly compute any polynomial with positive coefficients. Just as in the Boolean case, we have exponential lower bounds as well as natural separations between monotone and non-monotone circuits. Indeed, these arithmetic bounds predate the Boolean ones and are significantly simpler. Theorem 12.26 [SS79, TT94] PER requires monotone circuits of size exp(n).

154 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Theorem 12.27 [Val80] There is a positive polynomial f ∈ VP which requires exp(n) monotone circuits.

Multilinear circuits In multilinear circuits and formulae, every gate must compute a multilinear function. Clearly such circuits can compute every multilinear polynomial. Theorem 12.28 [Raz04a] DET requires multilinear formulae of size nΩ(log n). We know L(DET ) ≤ nO(log n), but the formula supplying this upper bound is not multilinear. Indeed, it is believed that DET actually requires exponential size multilinear circuits. Proving this, as well as proving any super polynomial circuit size lower bounds for multilinear circuits are important open problems.

ΣΠΣΠ-circuits This model sounds suspiciously restricted. Let us clarify its importance, and what exciting progress was made very recently in arithmetic complexity through studying it. Bounding the number of alternation of operations is standard in Boolean complexity and logic (e.g. first-order theories allow a finite number of alternations between existential and universal quantification). We also already saw in Section 12.2 similar restrictions on the number alternation between addition and multiplication of Boolean circuits. For example, ΣΠ-circuits captured the standard way of writing polynomials, as a sum of monomials. We saw in Theorem 12.6 that allowing one more alternation, ΣΠΣ-circuits (sum of products of sums), can give exponential advantage e.g. in computing the symmetric polynomials. And it stands to reason that allowing one more alternation will be more powerful, etc. etc. However, it was taken for granted that the decades-long study of such restricted circuits was mainly to slowly develop tools for “the real thing”, general circuit lower bounds. This sentiment changed overnight with a paper of Agrawal and Vinay [AV08]. They realized that the ideas of depth-reduction Theorem 12.5 can be pushed to squash circuits nontrivially to only four alternations, namely to ΣΠΣΠ-circuits. Their result was sharpened by both Koiran and Tavenas [Koi12, Tav13] to √ Theorem 12.29. If f ∈ VP, then f has a ΣΠΣΠ-circuits of size nO( n). Moreover, if f is homogeneous, the resulting circuit is homogeneous174. Thus, to prove general lower bounds, “all” we need are lower bounds for homogeneous ΣΠΣΠ- circuits. This gave a huge energy boost to attacks on such circuits, with the breakthrough result of Gupta, Kamath, Kayal and Saptharishi [GKKS13] which came extremely close to proving such lower bounds. A sequence of refinements led to a matching lower bound by Saraf and Kumar [SK14].

Theorem 12.30. √There exists an explicit homogeneous polynomial f ∈ VP, which requires ΣΠΣΠ- circuits of size nΩ( n).

Note that by the previous theorem, any non-constant improvement to the exponent in this lower bound (e.g. for the permanent) would separate VP and VNP! This lower bound of this theorem is achieved through the use of projected, shifted partial derivatives initiated by [GKKS13]. We will not explain this technique, but will brieﬂy explain its progenitor, the partial derivatives

174Namely, every gate in the circuit computes a homogeneous polynomial

155 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

technique. It was introduced by Nisan and Wigderson [NW96], who used it to prove lower bounds for the weaker ΣΠΣ-circuits, and other restricted models. These and more applications of the partial derivative method are surveyed in [SY10,CKW11]). The main idea is to deﬁne the following complexity measure on polynomials. For a multivariate polynomial g, consider the set PD(g) to be all polynomials which are partial derivatives of g (of all orders), and let dim(g) demote the dimension of the linear span of PD(g). This measure is small for input variables, and turns out to “progress slowly” under addition and multiplication. Thus, polynomials f with large dim(f) require large circuits!

Non-commutative circuits Non-commutativity is prevalent not only in math, but in life as well. Indeed, most pairs of actions we encounter or consider do not commute. Non-commutative polynomials occur naturally when the variables take values in a non-commutative ring, such as rings of matrices, or group algebras of non-commutative groups. So far in this section we implicitly assumed commutativity, namely that all our variables xi pairwise commute. Now we drop this assumption, and discuss non-commutative polynomials, and circuits and formulae for them. In non-commutative polynomials one has to specify the order of variable appearance in every monomial (e.g. xy and yx are different monomials). Similarly, in circuits and formulae we must specify the order of multiplication in product gates. A good demonstration of the weakness of this model is that while in the commutative setting we can compute x2 − y2 using one multiplication only, as (x − y)(x + y), this is impossible in the non- commutative setting. Nisan [Nis91a] proved exponential formula lower bounds for determinant175 (and permanent), and an exponential gap between the power of formulae and circuits. Theorem 12.31 [Nis91a] PER and DET require non-commutative formulae of size exp(n). Theorem 12.32 [Nis91a] There is a non-commutative polynomial with a linear size non-commutative circuit, which requires exp(n) non-commutative formulae. Note that the last theorem means that the depth reduction of Theorem 12.5, showing that formulae and circuits have near-equal power in the commutative case, is false in the non-commutative setting. Indeed, there are many other differences between these two worlds. A surprising one, due to Arvind and Srinivasan [AS10], is that in the non-commutative setting (the Cayley versions) of permanent and determinant are equally hard: DET ≤ PER and PER ≤ DET ! Yet another issue we discussed, Strassen’s efficient elimination of division gates when computing polynomials, is not known to be possible in the non-commutative setting (and seems to depend on certain problems in Invariant Theory [HW14]). The central problem in this area is proving super-polynomial circuit lower bounds. One attack [HWY10] shows how such (even exponential) lower bounds can be deduced from certain super-linear commutative circuit lower bounds.

175As discussed, to formally deﬁne this polynomial one has to order the variables in each monomial. A natural ordering we pick is row-order, called the Cayley-determinant.

156 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

13 Interlude: Concrete interactions between Math and Com- putational Complexity

The introduction discussed the variety of interactions between math and computation at a high level. In this section we will meet concrete examples of interactions of computational complexity theory with different fields of mathematics. We aim for variety—this section hopes to demonstrate that hardly any area of modern mathematics is untouched by this computational connection, which in some cases is quite surprising. We have chosen to focus on essentially one problem or development within each mathematical field. Typically this touches only a small subarea, which does not do justice to a wealth of connections. Thus each should be viewed as a demonstration of a larger body of work and even bigger potential. Indeed, while in some areas the collaborations are reasonably well established, in others they are just budding, with lots of exciting problems waiting to be solved and theories to be developed. While the descriptions are relatively short, they include background and intuition, as well as further reading material. Indeed, the vignettes in this section will hopefully tempt the reader to explore deeper. Here is a list of the covered areas and topics chosen in each; these sections can be read in any order. The selection of fields and foci is affected by my personal taste and limited knowledge. Connections to other fields like Combinatorics, Optimization, Logic, Topology and Information Theory already appear in parts of this text. Undoubtedly others could be added.

• Number Theory: Primality testing • Combinatorial Geometry: Point-line incidence • Operator Theory: The Kadison-Singer problem

• Metric Geometry: Distortion of embeddings • Group Theory: Generation and random generation • Statistical Physics: Monte-Carlo Markov chains

• Analysis and Probability: Noise stability • Lattice Theory: Short vectors • Invariant Theory: Actions on matrix tuples

13.1 Number Theory As mentioned, the need to eﬃciently compute mathematical objects has been central to mathematicians and scientists throughout history, and of course the earliest subject is arithmetic. Perhaps the most radical demonstration is the place value system we use to represent integers, which is in place for Millenia precisely due to the fact that it supports extremely eﬃcient manipulation of arithmetic operations. The next computational challenge in arithmetic, since antiquity, was accessing the multiplicative structure of integers represented this way.

157 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Here is an except from C. F. Gauss’ appeal176 to the mathematics community of his time (in article 329 of Disquisitiones Arithmeticae (1801)), regarding the computational complexity of testing primality and integer factorization. The importance Gauss assigns to this computational challenge, his frustration of the state of art, and his imploring the mathematical community to resolve it shine through! The problem of distinguishing prime numbers from composite numbers, and of resolving the latter into their prime factors is known to be one of the most important and useful in arithmetic. It has engaged the industry and wisdom of ancient and modern geometers to such an extent that it would be superfluous to discuss the problem at length. Nevertheless we must confess that all methods that have been proposed thus far are either restricted to very special cases or are so laborious and difficult that even for numbers that do not exceed the limits of tables constructed by estimable men, they try the patience of even the practiced calculator. And these methods do not apply at all to larger numbers . . . the dignity of the science itself seems to require that every possible means be explored for the solution of a problem so elegant and so celebrated. We briefly recount the state-of-art of these two basic algorithmic problems in number theory. A remarkable response to Gauss’ first question, efficiently deciding primality, was found in 2002 by Agrawal, Kayal, and Saxena [AKS04]. The use of symbolic polynomials for this problem is completely novel. Here is their elegant characterization of prime numbers. Theorem 13.1 [AKS04] An integer N ≥ 2 is prime if and only if • N is not a perfect power, • N does not have any prime factor ≤ (log N)4,

4 • For every r, a < (log N) we have the following equivalence of polynomials over ZN [X]: (X + a)N ≡ XN + a mod (Xr − 1)

It is not hard to see that this characterization gives rise to a simple algorithm for testing primality that is deterministic, and runs in time that is polynomial in the binary description length of N. Previous deterministic algorithms either assumed the generalize Riemann hypothesis [Mil76] or required slightly superpolynomial time [APR83]. The AKS deterministic algorithm came after a sequence of efficient probabilistic algorithms [SS77, Rab80, GK86, AH92], some elementary and some requiring sophisticated use and development of number theoretic techniques. These probabilistic and deterministic algorithms were partly motivated by, and are important to the field of cryptography. What is not so well-known, even for those who did read the beautiful, ingenious proof in [AKS04], is that AKS developed their deterministic algorithm by carefully “de-randomizing” a previous probabilistic algorithm for primality of [AB03] (which uses polynomials). We note that de-randomization, the conversion of probabilistic algorithms into deterministic ones, is by now a major area in computational complexity with a rich theory, and many other similar successes as well as challenges. The stunning possibility that every efficient probabilistic algorithm has a deterministic counterpart is one of the major problems of computational complexity, and there is strong evidence supporting it (see [IW97]). Much more on this can be found in the randomness chapters, especially Chapter7.

176Which is of course in Latin. I copied this English translation from a wonderful survey of Granville [Gra05] on the subject matter of this section.

158 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Gauss’ second challenge, of whether efficiently factoring integers is possible, remains open. But this very challenge has enriched computer science, both practical and theoretical in several major ways. Indeed, the assumed hardness of factoring is the main guarantee of security in almost all cryptographic and e-commerce systems around the world (showing that difficult problems can be useful!). More generally, cryptography is an avid consumer of number theoretic notions, including elliptic curves, Weil pairings, and more, which are critical to a variety of cryptographic primitives and applications. These developments shatter Hardy’s view of number theory as a completely useless intellectual endeavor. There are several problems on integers whose natural definitions depend on factorization, but can nevertheless be solved efficiently, bypassing the seeming need to factor. Perhaps the earliest algorithm ever formally described is Euclid’s algorithm for computing the GCD (greatest common divisor) of two given integers177 m and n. Another famous such algorithm is for computing the m Legendre-Jacobi symbol ( n ) via Gauss’ law of quadratic reciprocity. A fast algorithm for factoring may come out of left-field with the new development of quantum computing, the study of computers based on quantum-mechanical principles, which we discussed in the quantum Chapter 11. Shor has shown in [Sho94] that such computers are capable of factoring integers in polynomial time. This result led governments, companies, and academia to invest billions in developing technologies which will enable building large-scale quantum computers, and the jury is still out on the feasibility of this project. There is no known theoretical impediment for doing so, but one possible reason for failure of this project is the existence of yet-undiscovered principles of quantum mechanics. Other central computational problems include solving polynomial equations in finite fields, for which one of the earliest efficient (probabilistic) algorithm was developed by Berlekamp [Ber67] (it remains a great challenge to de-randomize this algorithm!). Many other examples can be found in the Algorithmic Number Theory book [BS97].

13.2 Combinatorial geometry What is the smallest area of a planar region which contains a unit length segment in every direction? This is the Kakeya needle problem (and such sets are called Kakeya sets), which was solved surprisingly by Besicovich [Bes19] who showed that this area can be arbitrarily close to zero! Slight variation on his method produces a Kakeya set of Lebesque measure zero. It makes sense to replace “area” (namely, Lesbegue measure) by the more robust measures, such as the Hausdorff and Minkowski dimensions. This changes the picture: Davies [Dav71] proved that a Kakeya set in the plane must have full dimension (=2) in both measures, despite being so sparse in Lebesgue measure. It is natural to extend this problem to higher dimensions. However, obtaining analogous results (namely, that the Hausdorff and Minkowski dimensions are full) turns out to be extremely difficult. Despite the seemingly recreational flavor, this problem has significant importance in a number of mathematical areas (Fourier analysis, Wave equations, analytic number theory, and randomness extraction), and has been attacked through a considerable diversity of mathematical ideas (see [Tao09]). The following finite field analogue of the above Euclidean problem was suggested by Wolff [Wol99]. Let F denote a finite field of size q. A set K ⊆ Fn is called Kakeya if it contains a line

177 It extends to polynomials, and allows eﬃcient way of computing multiplicative inverses in quotient rings of Z and F[x].

159 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

in every direction. More precisely, for every direction b ∈ Fn there is a point a ∈ Fn such that the line {a + bt : t ∈ F} is contained in K. As above, we would like to show that any such K must be large (think of the dimension n as a large constant, and the ﬁeld size q as going to inﬁnity).

n n Conjecture 13.2. Let K ⊆ F be a Kakeya set. Then |K| ≥ Cnq , where Cn is a constant depending only on the dimension n.

The best exponent of q in such a lower bound intuitively corresponds to the Hausdorff and Minkowski dimensions in the Euclidean setting. Using sophisticated techniques from arithmetic combinatorics, Bourgain, Tao and others improved the trivial bound of n/2 to about 4n/7. Curiously, the exact same conjecture arose, completely independently, within ToC, from the work [LRVW03] on randomness extractors, an area which studies the “purification” of “weak random sources”, which we discussed in Section 9.1 (see e.g. the survey [Vad11]). With this motivation, Dvir [Dvi09] brilliantly proved the Wolff conjecture (sometimes called the Finite Field Kakeya conjecture), using the (algebraic-geometric) “polynomial method” (which is inspired by techniques in decoding algebraic error-correcting codes). Many other applications of this technique to other geometric problems quickly followed, including the Guth-Katz [GK10] resolution of the famous Erd˝os distance problem, as well as for optimal randomness extraction and more (some are listed in Dvir’s survey [Dvi10]). Subsequent work determined the exact value of the constant Cn above (up to a factor of 2) [DKSS13]. Theorem 13.3 [DKSS13] Let K ⊆ Fn be a Kakeya set. Then |K| ≥ (q/2)n. On the other hand, there exist Kakeya sets of size ≤ 2 · (q/2)n. Many other problems regarding incidences of points and lines (and higher-dimensional geometric objects) have been the source of much activity and collaboration between geometers, algebraists, combinatorialists and computer scientists. The motivation for these questions in the computer science side come from various sources, e.g. problems on local correction of errors [BDWY13] and de- randomization [DS07,KS09]. Other incidence theorems, e.g. Szemerédi-Trotter [STJ83] and its finite field version of Bourgain-Katz-Tao [BKT04] have been used e.g. in randomness extraction [BIW06] and compressed sensing [GLR10].

13.3 Operator theory The following basic mathematical problem of Kadison and Singer from 1959 [KS59] was intended to formalize a basic question of Dirac concerning the “universality” of measurements in quantum mechanics. We need a few definitions. Consider B(H), the algebra of continuous linear operators on a Hilbert space H. Define a state to be a linear functional f on B(H), normalized to f(I) = 1, which takes non-negative values on positive semidefinite operators. The states form a convex set, and a state is called pure if it is not a convex combination of other states. Finally, let D be the sub-algebra of B(H) consisting of all diagonal operators (after fixing some basis). Kadison and Singer asked if every pure state on D has a unique extension to B(H). This problem on infinite-dimensional operators found a host of equivalent formulations in finite dimensions, with motivations and intuitions from operator theory, discrepancy theory, Banach space theory, signal processing, and probability. All of them were solved affirmatively in recent work of Marcus, Spielman, and Srivastava [MSS13b] (which also surveys the many related conjectures). Here is one statement they prove, which implies the others.

160 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Theorem 13.4 [MSS13b] For every > 0, there is an integer k = k() so that the following holds. Fix any n and any n × n matrix A with zeros on the diagonal and of spectral norm 1. Then there is a partition of {1, 2, ··· , n} into k subsets, S1,S2, ··· ,Sk, so that each of the principal minors Ai (namely A restricted to rows and columns in Si) has spectral norm at most . This statement clearly implies that one of the minors has linear size, at least n/k. This consequence is known as the Restricted Invertibility Theorem of Bourgain and Tzafriri [BT91], itself an important result in operator theory. How did computer scientists get interested in this problem? Without getting into too many details, here is a sketchy description of the meandering path which led to this spectacular result. A central computational problem, at the heart of numerous applications, is solving a linear system of equations. While Gaussian elimination does the job quite efficiently (the number of arithmetic operations is about n3 for n × n matrices), for large n this is still inefficient, and faster methods are sought, hopefully nearly linear in the number of non-zero entries of the given matrix. For Laplacian178 linear systems (arising in many graph theory applications, such as computing electrical flows and random walks), Spielman and Teng [ST11] achieved precisely that. A major notion they introduced was spectral sparsifiers of matrices (or weighted graphs). A sparsifier of a given matrix is another matrix, with far fewer (indeed, linear) non-zero entries, which nevertheless has essentially the same (normalized) spectrum as the original (it is not even obvious that such a sparse matrix exists). We note that a very special case of sparsifiers of complete graphs are by definition expander graphs179 (see much more about this central concept of expanders in [HLW06,Wig17]). The algorithmic applications led to a quest for optimal constructions of sparsifiers for arbitrary Laplacian matrices (in terms of trade-off between sparsity and approximation), and these were beautifully achieved in [BSS14] (who also provided a deterministic polynomial-time algorithm to construct such sparsifiers). This in turn has led [SS12] to a new proof, with better analysis, of the Restricted Invertibility theorem mentioned above, making the connection to the Kadison-Singer problem. However, the solution to Kadison-Singer seemed to require another detour. The same team [MSS13a] first resolved a bold conjecture of Bilu and Linial [BL06] on the spectrum of “signings” of ma- trices180. This conjecture was part of a plan for a simple, iterative construction of Ramanujan graphs, the best181 possible expander graphs. Ramanujan graphs were introduced and constructed in [LPS88, Mar88], but rely on deep results in number theory and algebraic geometry (believed by some to be essential for any such construction). Bilu and Linial sought instead an elementary construction, and made progress on their conjecture, showing how their iterative approach gives yet another way to construct “close to” Ramanujan expanders. To prove the Bilu-Linial conjecture (and indeed produce Ramanujan graphs of every possible degree—something the algebraic constructions couldn’t provide), [MSS13a] developed a theory of interlacing polynomials that turned out to be the key technical tool for resolving Kadison-Singer in [MSS13b]. In both cases, the novel view is to think of these conjectures probabilistically, and analyze the norm of a random operator by analyzing the average characteristic polynomial. That this method makes sense and actually works is deep and mysterious. Moreover, it provides a new

178Simply, symmetric PSD matrices with zero row sum. 179All non-trivial eigenvalues of the complete graph (or constant matrix) are 0, and an expander is a sparse graph in which all non-trivial eigenvalues are tiny. 180 Simply, this beautiful conjecture states that for every d-regular graph, there exist {−1, 1} signs of√ the edges√ which make all eigenvalues of the resulting signed adjacency matrix lie in the “Ramanujan interval” [−2 d − 1, 2 d − 1]. 181With respect to the spectral gap. This is one of a few important expansion parameters to optimize.

161 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

kind of existence proofs for which no eﬃcient algorithm (even probabilistic) of ﬁnding the desired objects is known. The analysis makes heavy use of the theory of Real stable polynomials, and the inductive process underlying it is reminiscent (and inspired by) Gurvits’ [Gur08] remarkable proof of the van der Waerden conjecture and its generalizations182.

13.4 Metric Geometry How close one metric space is to another is captured by the notion of distortion, measuring how distorted distances of one become when embedded into the other. More precisely, Deﬁnition 13.5. Let (X, d) and (X0, d0) be two metric spaces. An embedding f : X → X0 has distortion ≤ c if for every pair of points x, y ∈ X we have

d(x, y) ≤ d0(f(x), f(y)) ≤ c · d(x, y).

When X is ﬁnite and of size n, we allow c = c(n) to depend on n. Understanding the best embeddings between various metric and normed spaces has been a long endeavor in Banach space theory and metric geometry. An example of one major result in this area is Bourgain’s embedding theorem [Bou85].

Theorem 13.6 [Bou85] Every metric space of size n can be embedded into Euclidean space L2 with distortion O(log n). The first connection between these structural questions and computational complexity was made in the important paper of Linial, London and Rabinovich [LLR95]. They asked for efficient algorithms for actually finding embeddings of low distortion, and noticed that for some such problems it is natural to use semi-definite programming. They applied this geometric connection to get old and new results for algorithmic problems on graphs (in particular, the sparsest cut problem we will soon discuss. Another motivation they discuss (which quickly developed into a major direction in approximation algorithms) is that some computations (e.g. finding nearest neighbors) are more efficient in some spaces than others, and so efficient, low-distortion embedding may provide useful reductions from harder to easier space. They describe such an efficient algorithm implementing Bourgain’s Theorem 13.6 above, and also prove that his bound is best possible (the metric proving it is simply the distances between points in any constant-degree expander graph (see Section 8.7). The next shift in the evolution of this field, and in the level of interactions between geometers and ToC researchers, came from trying to prove “hardness of approximation” results. One example is the Goemans-Linial conjecture [Goe97, Lin02], studying the sparsest cut problem, about the 2 relation between L1 and the “negative type” metric space L2 (a general class of metrics which arise n naturally in several contexts). Roughly, these are metrics on R in which Euclidean√ distances are 2 squared. More precisely, a metric (X, d) is of negative type (namely, in L2), if (X, d), is isometric (has no distortion) to a subset of L2.

2 Conjecture 13.7. L2 can be embedded into L1 with constant distortion. This conjecture was proved false by Khot and Vishnoi [KV05], who proved

182This is yet another example of structural result (on doubly stochastic matrices) whose proof was partly motivated by algorithmic ideas. The connection is the use of hyperbolic polynomials in optimization (more speciﬁcally, as barrier functions in interior point methods.

162 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

2 Theorem 13.8 [KV05] For every n there are n-point subsets of L2 for which every embedding to 1/6 L1 requires distortion Ω(log log n) . Far more interesting than the result itself is its origin. Khot and Vishnoi were trying to prove that the (weighted) “sparsest cut” problem is hard to approximate. They managed to do so under a computational assumption, known as the Unique Games conjecture of Khot [Kho02] (see also [Kho10] and Section 4.3), via a so-called PCP-reduction (see Section 10.3). The elimination of this computational assumption is the magical part, that demonstrates the power and versatility of reductions between computational problems. They apply their PCP reduction to a particular, carefully chosen unique games instance, which cannot be well approximated by a certain semi-definite program. The outcome was an instance of the sparsest cut problem which the same reduction ensures is hard to approximate by a semi-definite program. As discussed above, that outcome instance could be understood as a metric space, and the hardness of approximation translates to the required distortion bound! 2 √ The exact distortion of embedding L2 into L1 has been determined precisely to be log n (up to lower order factors) in two beautiful sequences of works developing new algorithmic and geometric tools; we mention only the final word for each, as these papers contain a detailed history. On the√ upper bound side, the efficient algorithm approximating non-uniform sparsest cut to a factor log n log log n, which yields the same distortion bound, was obtained by Arora,√ Lee and Naor [ALN08] via the so-called “measured descent” method. A lower bound of log n on the distortion was very recently proved by Naor and Young [NY17] using a new isoperimetric inequality on the Heisenberg group. Another powerful connection between such questions and ToC is through (again) expander graphs. A basic example is that the graph metric of any constant-degree expander proves that Bourgain’s embedding theorem above is optimal! Much more sophisticated examples arise from trying to understand (and perhaps disprove) the Novikov and the Baum-Connes conjectures (see [KY06]). This program relies on another, much weaker notion of coarse embedding. Definition 13.9. (X, d) has a coarse embedding into (X0, d0) if there is a map f : X → X0 and two increasing, unbounded real functions α, β such that for every two points x, y ∈ X,

α(d(x, y)) ≤ d0(f(x), f(y)) ≤ β(d(x, y)).

Gromov [Gro03] was the first to prove that an infinite family of expanders cannot be coarsely embedded into a Hilbert space. This result was greatly generalized by Lafforgue [Laf08] and Mendel- Naor [MN14], who constructed graph metrics that cannot be coarsely embedded into any uniformly convex space. It is interesting that while Lafforgue’s method is algebraic, the Mendel-Naor construction follows the combinatorial zig-zag construction of expanders [RVW02] from computational complexity. Many other interaction projects regarding metric embeddings and distortion we did not touch on include their use in numerous algorithmic and data structure problems like clustering, distance oracles and the k-server problem, as well as the fundamental interplay between distortion and dimension reduction relevant to both geometry and CS, where so many basic problems are open.

13.5 Group Theory Group theorists, much like number theorists, have been intrinsically interested in computational problems since the origin of the ﬁeld. For example, the word problem (given a word in the generators

163 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

of some group, does it evaluate to the trivial element?) is so fundamental to understanding any group one studies, that as soon as language was created to formally discuss the computational complexity of this problem, hosts of results followed trying to pinpoint that complexity. These include decidability and undecidability results once Turing set up the theory of computation and provided the first undecidable problems, and these were followed with NP-completeness results and efficient algorithms once P and NP were introduced around 1970. Needless to say, these algorithmic results inform of structural complexity of the groups at hand. And the word problem is but the first example. Another demonstration is the beautiful interplay between algorithmic and structural advances over decades, on the graph isomorphism problem, recently leading to the breakthrough of Babai [Bab15]! A huge body of work is devoted to finding efficient algorithms for computing commutator subgroups, Sylow subgroups, centralizers, bases, representations, characters, and a host of other important substructures of a group from some natural description of it. Excellent textbooks include [HEO05, Ser03]. Here we focus on two related problems, the generation and random generation problems, and new conceptual notions borrowed from computational complexity which are essential for studying them. Before defining them formally (below), let us consider an example. Assume I hand you 10 invertible matrices, say 100 × 100 in size, over the field of size 3. Can you tell me if they generate another such given matrix? Can you even produce convincing evidence of this before we both perish? How about generating a random matrix in the subgroup spanned by these generators? The problem, of course, is that this subgroup will have size far larger than the number of atoms in the known universe, so its elements cannot be listed, and typical words generating elements in the group may need to be prohibitively long. Indeed, even the extremely special cases, for elements in ∗ Zp (namely one, 1 × 1 matrix), the first question is related to the discrete logarithm problem, and ∗ for Zp·q it is related to the integer factoring problem, both currently requiring exponential time to solve (as a function of the description length). Let us consider any finite group G and let n ≈ log |G| be roughly the length of a description of an element of G. Assume we are given k elements in G, S = {s1, s2, . . . , sk}. It would be ideal if the procedures we describe would work in time polynomial in n and k (which prohibits enumerating the elements of G, whose size is exponential in n). The generation problem asks if a given element g ∈ G is generated by S. How does one prove such a fact? A standard certificate for a positive answer is a word in the elements of S (and their inverses) which evaluates to g. However, even if G is cyclic, the shortest such word may be exponential in n. An alternative, computationally motivated description, is to give a program for g. Its definition shows that the term “program” suits it perfectly, as it has the same structure as usual computer programs, only that instead of applying some standard Boolean or arithmetic operations, we use the group operations of multiplication and inverse.

Definition 13.10. A program (over S) is a finite sequence of elements g1, g2, ··· , gm, where every element gi is either in S, or is the inverse of a previous gj, or is the product of previous gj, g`. We say that it computes g simply if g = gm. In the cyclic case, programs afford exponential savings over words in description length, as a program allows us to write large powers by repeatedly squaring elements. What is remarkable is that such savings are possible for every group. This discovery of Babai and Szemerédi[BS84] says that every element of every group has an extremely succinct description in terms of any set of elements generating it. Theorem 13.11 [BS84] For every group G, if a subset of elements S generates another element

164 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

g, then there is a program of length at most n2 ≈ (log |G|)2 which computes g from S. It is interesting to note that the proof uses a structure which is very combinatorial and counterintuitive for group theorists: that of a cube, which we will see again later. For a sequence t (h1, h2, ··· , ht) of elements from G, the cube C(h1, h2, ··· , ht) is the (multi)set of 2 elements 1 2 t {h1 , h2 , ··· , ht }, with i ∈ {0, 1}. Another important feature of the proof is that it works in a very general setting of “black-box” groups—it never needs an explicit description of the host group, only the ability to multiply elements and take their inverses. This is a very important paradigm for arguing about groups, and will be used again below. How does one prove that an element g is not generated by S? It is possible that there is no short “classical” proof! This question motivated Babai to define Arthur-Merlin games—a new notion of probabilistic, interactive proofs (simultaneously with Goldwasser, Micali, and Rackoff [GMR89], who proposed a similar notion for cryptographic reasons), and showed how non-membership can be certified in this new framework. The impact of the definition of interactive proofs on the theory of computation has been immense, and was discussed in Section 10.1. Returning to the generation problem, let us now consider the more challenging problem of random generation. Here we are given S, and would like a randomized procedure which will quickly output an (almost) uniform distribution on the subgroup H of G generated by S. This problem, besides its natural appeal, is often faced by computational group theorists, being a subroutine in many group-theoretic algorithms. In practice heuristics are used, like the famous “product replacement algorithm” and its variants, which often work well (see e.g. the recent [BLG12] and references). We will discuss here provable bounds. It is clear that sufficiently long random words in the elements of S and its inverses will do the job, but just as with certificates, sufficiently long is often prohibitively long. In a beautiful paper, Babai [Bab91] describes a certain process generating a random program which computes a nearly-uniform element of H, and runs in time n5 ≈ (log |G|)5 steps. It again uses cubes, and works in the full generality of black-box groups. This paper was followed by even faster algorithms with simpler analysis by Cooperman and by Dixon [Coo02, Dix08], and the state-of-art is an algorithm whose number of steps is remarkably the same as the length of proofs of generation above—in other words, randomness achieves the efficiency of non-determinism for this problem. Summarizing: Theorem 13.12 [Bab91, Coo02, Dix08] For every group G, there is a probabilistic program of length poly(n) ≈ poly(log |G|) that, given any generating set S for G, produces with high probability a (nearly) uniformly random element of G.

13.6 Statistical Physics The field of statistical physics is huge, and we focus here mainly on connections of statistical mechanics with the theory of computation. Numerous mathematical models exist of various physical and chemical systems, designed to understand basic properties of different materials and the dynamics of basic processes. These include such familiar models as Ising, Potts, Monomer-Dimer, Spin-Glass, Percolation, etc. A typical example explaining the connection of such mathematical models to physics and chemistry, and the basic problems studied is the seminal paper of Heilmann and Lieb [HL72]. Many of the problems studied can be viewed in the following general setting. We have a huge (exponential) space of objects called Ω (these objects may be viewed as the different configurations of a system). Each object is assigned a nonnegative weight (which may be viewed as the “energy” of that state). Scaling these weights gives rise to a probability distribution (often called the Gibbs

165 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

distribution) on Ω, and to study its properties (phase transitions, critical temperatures, free energy, etc.) one attempts to generate samples from this distribution (if the description of a state takes n bits, then listing all probabilities in question is exponentially prohibitive). As Ω may be highly unstructured, the most common approach to this sampling problem is known as “Monte Carlo Markov Chain” (or “MCMC”) method. The idea is to build a graph on the objects of Ω, with a pair of objects connected by an edge if they are similar in some sense (e.g. sequences which differ only in a few coordinates). Next, one starts from any object, and performs a biased random walk on this graph for some time, and the object reached is the sample produced. In many settings it is not hard to set up the random walk (often called Glauber dynamics or the Metropolis algorithm) so that the limiting distribution of the Markov chain is indeed the desired distribution. The main question in this approach is when to stop the walk and output a sample; when are we close enough to the limit? In other words, how long does it take the chain to converge to the limit? In most cases, these decisions were taken on intuitive, heuristic grounds, without rigorous analysis of convergence time. The exceptions where rigorous bounds were known were typically structured, e.g. where the chain was a Cayley graph of a group (e.g. [Ald83, Dia88]). This state of affairs has changed considerably since the interaction in the past couple of decades with the theory of computation. Before describing it, let us see where computational problems even arise in this field. The two major sources are optimization and counting. That the setting above suits many instances of optimization problems is easy to see. Think of Ω as the set of solutions to a given optimization problem (e.g. the values of certain parameters designed to satisfy a set of constraints), and the weights representing the quality of a solution (e.g. the number of constraints satisfied). So, picking at random from the associated distribution favors high-quality solutions. The counting connection is more subtle. Here Ω represents a set of combinatorial objects one wants to count or approximate (e.g. the set of perfect matchings in a graph, or satisfying assignments to a set of constraints). It turns out that for many such settings, sampling an object (approximately) at random allows a recursive procedure to approximate the size of the set [JVV86]. Moreover, viewing the finite set as a fine discretization of a continuous object (e.g. lattice points in a convex set) allows one to compute volumes and more generally integrate functions over such domains. Around 1990, rigorous techniques were introduced [Ald90, Bro89, SJ89, DFK91] to analyze the convergence rates of such general Markov chains arising from different approximation algorithms. They establish conductance bounds on the Markov chains, mainly via canonical paths or coupling arguments (a survey of this early work is [JS96]). Collaborative work was soon able to formally justify the physical intuition behind some of the suggested heuristics for many models, and moreover drew physicists to suggest such ingenious chains for optimization problems. The field drew in probabilists and geometers as well, and by now is highly active and diverse. We mention two results to illustrate rigorous convergence bounds for important problems of this type. Theorem 13.13 [JSV04] The permanent of any nonnegative n × n matrix can be approximated, to any multiplicative factor (1 + ), in polynomial time in n/. The importance of this approximation algorithm stems from the seminal result of Valiant [Val79b] that the permanent183 polynomial is universal for essentially all counting problems (in particular those arising in the statistical physics models and optimization and counting problems above). So, unlike determinant, computing it exactly is extremely difficult. Theorem 13.14 [DFK91] The volume of any convex set in n dimensions can be approximated, to any multiplicative factor (1 + ), in polynomial time in n/.

183The notorious sibling of the determinant, in which no signs appear, was deﬁned and discussed in Section 12.

166 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

The volume, besides its intrinsic interest, captures as well natural counting problems, e.g. the number of extensions of a given partially ordered set. The analysis of this algorithm, as well as its many subsequent improvements has lead to purely structural results of independent interest in convex geometry, as well to generalizations like efficient sampling from any log-concave distribution (see the survey [Vem05]). Another consequence of this collaboration was a deeper understanding of the relation between spacial properties (such as phase transitions, and long-range correlations between distant sites in the Gibbs distribution) and temporal properties (such as speed of convergence of the sampling or approximately counting algorithms, like Glauber dynamics). This connection (surveyed e.g. in [DSVW04]) was established by physicists for spin systems since the 1970s. The breakthrough work of Weitz [Wei06] on the hard core model gave an deterministic algorithm which is efficient up to the phase transition, and this was complemented by a hardness result of Sly [Sly10] beyond the phase transition. These phase transition of computational complexity, at the same point as the phase transition of the Gibbs distribution are striking, and the generality of this phenomenon is still investigated. More generally, the close similarity between statistical physics models and optimization problems, especially on random instances, is benefitting both sides. Let us mention a few exciting developments. It has unraveled the fine geometric structure of the space of solutions at the phase transition, pinpointing it e.g. for k-SAT in [ACORT11]. Physics intuition based on such ideas as renormalization, annealing, and replica symmetry breaking, has led to new algorithms for optimization problems, some of them now rigorously analyzed, e.g. as in [JS93]. Others, like one of the fastest (yet unproven) heuristics for such problems as Boolean Satisfiability (which is NP-complete in general) are based on the physics method of “survey propagation” of [MPZ02]. The Lovasz Local Lemma (LLL) enables to establish the existence of rare “global” events. Efficient algorithmic versions of the LLL were initiated by Beck [Bec91], and starting with the work of Moser [Mos09] (and then [MT10]), have led to approximate counting and uniform sampling versions for rare events (see e.g. [GJL16]). These new techniques for analyzing directed, non-reversible Markov chains are a new powerful tool for many more applications. A completely different deterministic algorithm of Moitra [Moi16] in the LLL regime promises many more applications; it works even when the solution space (and hence the natural Markov chain) is not connected!

13.7 Analysis and Probability This section gives a taste of a growing number of families of inequalities—large deviation inequalities, isoperimetric inequalities, etc.—that have been generalized beyond their classical origins due to a variety of motivations in the theory of computing and discrete mathematics. Further, the applications sometimes call for stability versions of these inequalities, namely an understanding of the structures which make an inequality nearly sharp. Here too these motivations pushed for generalizations of classical results and many new ones. Most of the material below, and much more on the motivations and developments in this exciting area of the analysis of Boolean functions, can be found in the book [O’D14] by O’Donnell. The following story can be told from several angles. One is the noise sensitivity of functions. We restrict ourselves to the Boolean cube endowed with the uniform probability measure, but many of the questions and results extend to arbitrary product probability spaces. Let f : {−1, 1}n → R, which we assume is balanced, namely E[f] = 0. When the image of f is {−1, 1}, we can think of f as a voting scheme, translating the binary votes of n individuals into a binary outcome. One natural

167 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

desire from such a voting scheme may be noise stability—that typically very similar inputs (vote vectors) will yield the same outcome. While natural in this social science setting, such questions also arise in statistical physics settings, where natural functions such as bond percolation turn out to be extremely sensitive to noise [BKS99]. Let us formally define noise stability. Definition 13.15. Let ρ ∈ [0, 1] be a correlation parameter. We say two vectors x, y ∈ {−1, 1}n are ρ-correlated if they are distributed as follows. The vector x is drawn uniformly at random, and y is obtained from x by flipping each bit xi independently with probability (1 − ρ)/2. Note that for every i the correlation E[xiyi] = ρ. The noise sensitivity of f at ρ, Sρ(f), is simply defined as the correlation of the outputs, E[f(x)f(y)]. It is not hard to see that the function maximizing noise stability is any dictatorship function, e.g. f(x) = x1, for which Sρ(f) = ρ. But another natural social scientific concern is the influence of players in voting schemes [BOL85], which prohibits such solutions (in democratic environments). Influence of a voter is the probability with which it can change the outcome given that all other votes are uniformly random (so, in a dictatorship it is 1 for the dictator and 0 for all others). A fair voting scheme should have no voter with high influence. As we define influence for Real-valued functions, we will use the (conditional) variance to measure a player’s potential effect given all other (random) votes. n Definition 13.16. A function f : {−1, 1} → R has influence τ if for every i, Var[xi|x−i] ≤ τ for all i (where x−i denotes the vector x without the ith coordinate). √ For example, the majority function has influence O(1/ n). The question of how small the influence of a balanced function can be is extremely interesting, and leads to a highly relevant inequality for our story (both in content and techniques). As it turns out, ultimate fairness (influence 1/n per player) is impossible— [KKL88] show that every function has a player with nonproportional influence, at least Ω(log n/n). At any rate, one can ask which of the functions with small influence is most stable, and it is natural to guess that majority should be the best184. The conjecture that this is the case, called the Majority is Stablest conjecture, arose from a completely different and surprising angle—the field of optimization, specifically “hardness of approximation”. A remarkable paper [KKMO07] has shown that it implies185 the optimality of a certain natural algorithm for approximating the maximum cut of a graph (the partition of vertices so as to maximize the number of edges between them—a basic optimization problem whose exact complexity is NP-complete). This connection is highly non-trivial, but by now we have many examples showing how the analysis of certain (semidefinite programming-based) approximation algorithms for a variety of optimization problems raise many new isoperimetric questions, enriching this field. The Majority is Stablest conjecture was proved in a strong form by [MOO10] shortly after it was posed. Here is a formal statement (which actually works for bounded functions). Theorem 13.17 [MOO10] For every (positive correlation parameter) ρ ≥ 0 and > 0 there exists (an influence bound) τ = τ(ρ, ) such that for every n and every f : {−1, 1}n → [−1, 1] of influence at most τ, Sρ(f) ≤ Sρ(Majorityn) + . The proof reveals another angle on the story—large deviation inequalities and invariance principles. To see the connection, recall the Berry-Esseen theorem [Fel71], generalizing the standard

184 2 This noise sensitivity tends, as n grows, to Sρ(Majorityn) = π arcsin ρ. 185Assuming another, complexity-theoretic, conjecture called the “Unique Games” conjecture, discussed in Sec- tion 4.3.

168 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

central limit theorem to weighted sums of independent random signs. In this theorem, influences Pn P 2 arise very naturally. Consider i=1 cixi. If we normalize the weights ci to satisfy i ci = 1, then ci is the influence of the ith voter, and τ = maxi |ci|. The quality of this central limit theorem deteriorates linearly with the influence τ. Lindeberg’s proof of Berry-Esseen uses an invariance principle, Pn showing that for linear functions, the cumulative probability distribution P r[ i=1 cixi ≤ t] (for every t) is unchanged (up to τ), regardless of the distribution of the variables xi, as long as they are independent and have expectation 0 and variance 1. Thus, in particular, they can be taken to be standard Gaussian, which trivializes the problem, as the weighted sum is a Gaussian as well! To prove their theorem, [MOO10] first observed that also in the noise stability problem, the Gaussian case is simple. If the xi, yi are standard Gaussians with correlation ρ, the stability problem reduces to a classical result of Borell [Bor85]: that noise stability is maximized by any hyperplane through the origin. Note that here the rotational symmetry of multidimensional Gaus- sians, which also aids the proof, does not distinguish “dictator” functions from majority—both are such hyperplanes. Given this theorem, an invariance principle whose quality depends on τ would do the job. They next show that it is sufficient to prove the principle only for low degree multilinear polynomials (as the effect of noise decays with the degree). Finally, they prove this non-linear extension of Berry-Esseen for such polynomials, a form of which we state below. They also use their invariance principle to prove other conjectures, and since the publication of their paper, quite a number of further generalizations and applications were found.

Theorem 13.18 [MOO10] Let xi be any n independent random variables with mean 0, variance 1 and bounded 3rd moments. Let gi be n independent standard Gaussians. Let Q be any degree d multilinear n-variate polynomial of influence τ. Then for any t, |P r[Q(x) ≤ t] − P r[Q(g) ≤ t]| ≤ O(dτ 1/d). We now only seem to be switching gears... To conclude this section, let me give one more, very different demonstration of the surprising questions (and answers) regarding noise stability and isoperimetry, arising from the very same computational considerations of optimization of hardness of approximation. Here is the question : What is the smallest surface area of a (volume 1) body which tiles Rd periodically along the integer lattice Zd? Namely, we seek a d-dimensional volume 1 subset B ⊆ Rd such that B + Zd = Rd, such that its boundary has minimal (d − 1)-dimensional volume186. Let us denote this infimum by s(d). The curious reader can stop here a bit and test your intuition, what do you expect the answer to be, asymptotically in d? Such questions originate from the late 19th century study by Thomson (later Lord Kelvin) of foams in 3 dimensions [Tho87], further studied, generalized and applied in mathematics, physics, chemistry, material science and even architecture. However, for this very basic question, where periodicity is defined by the simplest integer lattice, it seems that, for large d, the trivial upper and lower bounds on s(d) were not improved on for over a century. The trivial upper bound on s(d) is provided by the unit cube, which has surface area 2d. The trivial lower bound on s(d) comes from ignoring the tiling restriction,√ and considering only the volume - here the unit volume ball has the smallest surface area, 2πed. Where√ in this quadratic range does s(d) lie? In particular, can there be “spherical cubes”, with s(d) = O( d)? The last question became a central issue for complexity theorists when [FKO07] related it directly to the important Unique Games conjecture, and optimal inapproximability proofs of combinatorial problems (in particular the maximum cut problem) discussed above. The nontrivial

186Note that the volume of B ensures that the interiors of B + v and B + u are disjoint for any two distinct integer d vectors u, v ∈ Z , so this gives a tiling.

169 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

connection, which the paper elaborates and motivates, goes through attempts to ﬁnd the tightest version of Raz’ [Raz98a] celebrated parallel repetition theorem187. A limit on how “strong” a parallel repetition theorem can get was again provided by Raz [Raz11]. Extending his techniques to the geometric, continuous setting, [KORW08] resolved the question above, proving that “spherical cubes” do exist! √ Theorem 13.19 [KORW08] For all d, s(d) ≤ 4πd A simple proof, and various extensions of this result were given subsequently in [AK09]. We note that all known proofs are probabilistic. Giving an explicit construction that might better illustrate how a “spherical cube” (even with much worse but non-trivial surface are) looks like, seems like a challenging problem.

13.8 Lattice Theory Lattices in Euclidean space are among the most “universal” objects in mathematics, in that besides being natural (e.g. arising in crystalline structures) and worthy of study in their own right, they capture a variety of problems in different fields such as number theory, analysis, approximation theory, Lie algebras, convex geometry, and more. Many of the basic results in lattice theory, as we shall see, are existential (namely supply no efficient means for obtaining the objects whose existence is proved), which in some cases has limited progress on these applications. This section tells the story of one algorithm, of Lenstra, Lenstra, and Lovász[LLL82], often called the LLL algorithm, and some of its implications on these classical applications as well as modern ones in cryptography, optimization, number theory, symbolic algebra and more. But we had better define a lattice188 first. n Let B = {b1, b2, . . . , bn} be a basis of R . Then the lattice L(B) denotes the set (indeed, Abelian P group) of all integer linear combinations of these vectors, i.e. L(B) = { i zibi : zi ∈ Z}. B is also called a basis of the lattice. Naturally, a given lattice can have many different bases, e.g. the standard integer lattice in the plane, generated by {(0, 1), (1, 0)}, is equally well generated by {(999, 1), (1000, 1)}. A basic invariant associated with a lattice L is its determinant d(L), which is the absolute value of det(B) for any basis B of L (this is also the volume of the fundamental parallelpiped of the lattice). For simplicity and without loss of generality, we will assume that B is normalized so that we only consider lattices L of d(L) = 1. The most basic result about lattices, namely that they must contain short vectors (in any norm) was proved by Minkowski (who initiated Lattice Theory, and with it, the Geometry of Numbers) [Min10]. Theorem 13.20 [Min10] Consider an arbitrary convex set K in Rn which is centrally symmetric189 and has volume > 2n. Then, every lattice L (of determinant 1) has a nonzero point in K. This innocent theorem, which has a simple, but existential (pigeonhole) proof, turns out to have numerous fundamental applications in geometry, algebra and number theory. Among famous examples this theorem yields with appropriate choice of norms and lattices, results like Dirichlet’s Diophantine approximation theorem and Lagrange’s four-squares theorem, and (with much more work) the finiteness of class numbers of number fields (see e.g. [PZ89]).

187A fundamental information theoretic inequality of central importance to “amplification” of Probabilistically Checkable Proofs (PCPs). 188We only define full-rank lattices here, which suffice for this exposition. 189Namely, x ∈ K implies that also −x ∈ K. Such sets are precisely balls of arbitrary norms.

170 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

From now on we will focus on short vectors in the (most natural) Euclidean norm. A direct corollary of Minkowski’s theorem when applying it to the cube K = [−1, 1]n yields:

√Corollary 13.21. Every lattice L of determinant 1 has a nonzero point of Euclidean norm at most n.

Digressing a bit, we note that very recently, a century after Minkowski, a strong converse of the above corollary190 conjectured by Dadush (see [DR16]) for computational motivation, has been proved in [RSD16]. This converse has many structural consequences, on the covering radius of lattices, arithmetic combinatorics, Brownian motion and others. We will not elaborate here on this new interaction of computational complexity and optimization with lattice theory and convex geometry. The papers above beautifully motivate these connections and applications, and the history of ideas and technical work needed for this complex proof. Returning to Minkowski’s corollary for the Euclidean norm, the proof is still existential, and the obvious algorithm for finding such a short vector requires exponential time in n. The breakthrough paper [LLL82] describe the LLL algorithm, an efficient, polynomial-time algorithm, which approximates the length of the shortest vector in any n-dimensional lattice by a 2n factor. Theorem 13.22 [LLL82] There is a polynomial-time algorithm, which given any lattice L produces a vector in L of Euclidean length at most 2n factor longer than the shortest vector in L. This exponential bound may seem excessive at first, but the number and diversity of applications is staggering. First, in many problems, the dimension n is a small constant (so the actual input length arises from the bit-size of the given basis). This leads, for instance, to Lenstra’s algorithm for (exactly solving) Integer Programming [Len83] in constant dimensions. It also leads to Odlyzko and Riele’s refutation [OtR85] of Mertens’ conjecture about cancellations in the Möbiusfunction, and to the long list of number theoretic examples in [Sim10]. But it turns out that even when n is arbitrarily large, many problems can be solved in poly(n)-time as well. Here is a list of examples of old and new problems representing this variety, some going back to the original paper [LLL82]. In all, it suffices that real number inputs are approximated to poly(n) digits in dimension n. • Diophantine approximation. While the best possible approximation of one real number by rationals with bounded denominator is readily solved by its (efficiently computable) continued fraction expansion, no such procedure is known for simultaneous approximation. Formally, given a set of real numbers, say {r1, r2, . . . , rn}, a bound Q and > 0, find integers q ≤ Q and p1, . . . , pn such that all |ri − pi/q| ≤ . Existentially (using Minkowski), the Dirichlet “box- 2 principle” shows that < Q1/n is possible. Using LLL, one efficiently obtains < 2n Q1/n which is meaningful for Q described by poly(n) many bits. • Minimal polynomials of algebraic numbers. Here we are given a single real number r and a degree bound n, and are asked if there is a polynomial g(x) with integer coefficients, of degree at most n of which r is a root (and also to produce such a polynomial g if it exists). i Indeed, this is a special case of the problem above with ri = r . While the algorithm only outputs g for which g(r) ≈ 0, it is often easy to check that it actually vanishes. Note that by varying n we can find the minimal such polynomial. • Polynomial factorization over Rationals. Here the input is an integer polynomial h of degree n, and we want to factor it over Q. The high level idea is to first find an (approximate) 190Which has to be precisely formulated.

171 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

root r of h (e.g. using Newton’s method), feed it to the problem above, which will return a minimal g having r as a root, and thus divides h. We stress that this algorithm produces the exact factorization, not an approximate one!

• Small integer relations between reals. Given reals r1, r2, . . . rn, and a bound Q, determine P if there exist integers |zi| < Q such that i ziri = 0 (and if so, ﬁnd these integers). As a famous example, LLL can ﬁnd an integer relation among arctan(1) ≈ 0.785398, arctan(1/5) ≈ 0.197395 and arctan(1/239) ≈ 0.004184, yielding Machin’s formula

arctan(1) − 4 arctan(1/5) + arctan(1/239) = 0

• Cryptanalysis. Note that a very special case of the problem above (in which the coeﬃ- cients zi must be Boolean) is the “Knapsack problem,” a famous NP-complete problem. The point here is that in the early days of cryptography, some systems were based on the assumed “average case” hardness of Knapsack. Many such systems were broken by using LLL, e.g. [Lag84]. LLL was also used to break some versions of the RSA cryptosystem (with “small public exponents”).

It is perhaps a fitting epilogue to the last item that lattices cannot only destroy cryptosystems, but also create them. The problem of efficiently approximating short vectors up to polynomial (as opposed to exponential, as LLL produces) factors is believed to be computationally hard. Here are some major consequences of this assumption. First, Ajtai showed in a remarkable paper [Ajt96] that such hardness is preserved “on average”, over a cleverly-chosen distribution of random lattices. This led to a new public-key encryption scheme by Ajtai and Dwork [AD97] based on this hardness, which is arguably the only one known that can potentially sustain quantum attacks (Shor’s efficient quantum algorithms can factor integers and compute discrete logarithms [Sho94]). In another breakthrough work of Gentry [Gen09a], this hardness assumption is used to devise fully homomorphic encryption, a scheme which allows not only to encrypt data, but to perform arbitrary computations directly with encrypted data. See more in this excellent survey [Pei16].

13.9 Invariant Theory Invariant theory, born in an 1845 paper of Cayley [Cay45], is major branch of algebra, with important natural connections to algebraic geometry and representation theory, but also to many other areas of mathematics. We will see some here, as well as some new connections with computational complexity, leading to new questions and results in this ﬁeld. We note that computational eﬃ- ciency was always important in invariant theory, which is rife with ingenious algorithms (starting with Cayley’s Omega process), as is evident from the books [CLO92, Stu08, DK15]. Invariants are familiar enough, from examples like the following. • In high school physics we learn that energy and momentum are preserved (namely, are invariants) in the dynamics of general physical systems. • In chemical reactions the number of atoms of each element is preserved as one mixture of molecules is transformed to yield another (e.g. as combining Sodium Hydroxide (NaOH) and Hydrochloric Acid (HCl) yields the common salt Sodium Chloride (NaCl) and Water (H2O)).

172 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• In geometry, a classical puzzle asks when can a plane polygon be “cut and pasted” along straight lines to another polygon. Here the obvious invariant, area, is the only one!191. How- ever in generalizing this puzzle to 3-dimensional polyhedra, it turns out that besides the obvious invariant, volume, there is another invariant, discovered by Dehn192. More generally, questions about the equivalence of two surfaces (e.g. knots) under homeomorphism, whether two groups are isomorphic, or whether two points are in the same orbit of a dynamical system, etc., all give rise to similar questions and treatment. A canonical way to give negative answers to such questions is through invariants, namely quantities preserved under some action on an underlying space. We will focus on invariants of linear groups acting on vector spaces. Let us present some notation. Fix a field F (while problems are interesting in every field, results mostly work for infinite fields only, and sometimes just for characteristic zero or algebraically closed ones). Let G be a group, and V a representation of G, namely an F-vector space on which G acts: for every g, h ∈ G and v ∈ V we have gv ∈ V and g(hv) = (gh)v. The orbit under G of a vector (or point) v ∈ V , denoted Gv is the set of all points that v can be moved to by this action, namely Gv = {gv : g ∈ G}. Understanding the orbits of a group objects is a central task of this field. A basic question capturing many of the examples above is, given two points u, v ∈ V , do they lie in the same G-orbit, namely if u ∈ Gv. A related basic question, which is even more natural in algebraic geometry (when the field F is algebraically closed of characteristic zero) is whether the closures193 of the two orbits intersect, namely if some point in Gu can be approximated arbitrarily well by points in Gv. We will return to specific incarnations of these questions. When G acts on V , it also acts on F[V ], the polynomial functions on V , also called the coordinate ring of V . In our setting V will have finite dimension (say m), and so F[V ] is simply F[x1, x2, . . . , xm] = F[X], the polynomial ring over F in m variables. We will denote by gp the action of a group element g ∈ G on a polynomial p ∈ F[V ]. A polynomial p(X) ∈ F[X] is invariant if it is unchanged by this action, namely for every g ∈ G we have gp = p. All invariant polynomials clearly form a subring of F[X], denoted F[X]G, called the ring of invariants of this action. Understanding the invariants of group actions is the main subject of Invariant Theory. A fundamental result of Hilbert [Hil93] shows that in our linear setting194, all invariant rings will be finitely generated as an algebra195. Finding the “simplest” such generating set of invariants is our main concern here. Two familiar examples of perfect solutions to this problem follow.

• In the ﬁrst, G = Sm, the symmetric group on m letters, is acting on the set of m formal variables X (and hence the vector space they generate) by simply permuting them. Then a set of generating invariants is simply the ﬁrst m elementary symmetric polynomials in X.

191And so, every two polygons of the same area can be cut to produce an identical (multi)sets of triangles. 192So there are pairs of 3-dimensional polyhedra of the same volume, which cannot be cut to identical (multi)sets of tetrahedra. 193One can take closure in either the Euclidean or the Zariski topology (the equivalence in this setting proved by Mumford [Mum95]). 194The full generality under which this result holds is actions of reductive groups, which we will not deﬁne here, but includes all examples we discuss. 195 G This means that there is a ﬁnite set of polynomials {q1, q2, . . . , qt} in F[X] so that for every polynomial G p ∈ F[X] there is a t-variate polynomial r over F so that p = r(q1, q2, . . . , qt).

173 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• In the second, G = SLn(F), the simple linear group of matrices with determinant 1, is acting 2 on the vector space Mn(F) of n×n matrices (so m = n ), simply by left matrix multiplication. In this case all polynomial invariants are generated by a single polynomial, the determinant of this m-variable matrix X.

In these two cases, which really supply a complete understanding of the invariant ring F[X]G, the generating sets are good in several senses. There are few generating invariants, they all have low degree, and they are easy to compute196—all these quantities are bounded by a polynomial in m, the dimension of the vector space197 . In such good cases, one has eﬃcient algorithms for the basic problems regarding orbits of group actions. For example, a fundamental duality theorem of Geometric Invariant Theory [MFK82] (see Theorem A.1.1), show how generating sets of the invariant ring can be used for the orbit closure intersection problem. Theorem 13.23 [MFK82] For an algebraically closed ﬁeld F of characteristic 0, the following are equivalent for any two u, v ∈ V and generating set P of the invariant ring F[X]G. • The orbit closures of u and v intersect. • For every polynomial p ∈ P , p(v) = p(u).

13.9.1 Geometric Complexity Theory (GCT) We now briefly explain one direction from which computational complexity became interested in these algebraic problems, in work that has generated many new questions and collaboration between the fields. First, some quick background on the main problem of arithmetic complexity theory (see Chapter 12 for definitions and more discussion). In [Val79b] Valiant defined arithmetic analogs VP and VNP of the complexity classes P and NP respectively, and conjectured that these two arithmetic classes are different (see Conjecture 12.21). He further proved (via surprising completeness results) that to separate these classes it is sufficient to prove that the permanent polynomial on n×n matrices does not project to the determinant polynomial on m × m matrices for any m = poly(n). Note that this is a pure and concrete algebraic formulation of a central computational conjecture. In a series of papers, Mulmuley and Sohoni introduced Geometric Complexity Theory (GCT) to tackle this major open problem198. This program is surveyed by Mulmuley here [Mul12a,Mul11], as well as in Landsberg’s book [Lan17]. Very concisely, the GCT program starts off as follows. First, a simple “padding” of the n×n permanent polynomial makes it have degree m and act on the entries of an m × m matrix. Consider the linear group SLm2 action on all entries of such m × m matrices. This action extends to polynomials in those variables, and so in particular the two we care about: determinant and modified permanent. The main connection is that the permanent projects to the determinant (in Valiant’s sense) if and only if the orbit closures of these two polynomials intersect. Establishing that they do not intersect (for m = poly(n)) naturally leads to questions about finding representation theoretic obstructions to such intersection (and hence, to the required computational lower bound). This is where things get very complicated, and describing them is beyond the scope of this survey. We note that to date, the tools of algebraic geometry and representation theory were not sufficient even to improve the quadratic bound on m of Theorem 12.25. Indeed, some

196E.g. have small arithmetic circuits or formulae. 197There are additional desirable structural qualities of generating sets that we will not discuss, e.g. completely understanding algebraic relations between these polynomials (called syzygies). 198Origins of using invariant theory to argue computational diﬃculty via similar techniques go back to Strassen [Str87].

174 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

recent developments show severe limitations to the original GCT approach (and perhaps guiding it in more fruitful directions); see [BIP16] and its historical account. Nevertheless, this line of attack (among others in computational complexity) has lead to many new questions in computational commutative algebra and to growing collaborations between algebraists and complexity theorists – we will describe some of these now. To do so, we will focus on two natural actions of linear groups on tuples of matrices, simultaneous conjugation and the left-right action. Both are special cases of quiver representations (see [Gab72, DW06])199. For both group actions we will discuss the classical questions and results on the rings of invariants, and recent advances motivated by computational considerations.

13.9.2 Simultaneous Conjugation

2 Consider the following action of SLn(F) on d-tuples of n × n matrices. We have m = dn variables arranged as d n×n matrices X = (X1,X2,...,Xd). The action of a matrix Z ∈ SLn(F) on this tuple −1 −1 −1 is by simultaneous conjugation, by transforming it to the tuple (Z X1Z,Z X2Z, ··· ,Z XdZ). Now, the general question above, for this action, is which polynomials in the variables X are invariant under this action? The work of Procesi, Formanek, Razmyslov, and Donkin [Pro76,For84,Raz74,Don92] provides a good set (in most aspects discussed above) of generating invariants (over algebraically closed ﬁelds of characteristic zero). The generators are simply the traces of products of length at most n2 of the given matrices200. Namely the set

2 {T r(Xi1 Xi2 ··· Xit ): t ≤ n , ij ∈ [d]}.

These polynomials are explicit, have small degree and are easily computable. The one shortcoming is the exponential size of this generating set. For example, using it to decide the intersection of orbit closures will only lead to an exponential time algorithm. By Hilbert’s existential Noether’s normalization lemma [Hil93]201 we know that the size of this set of generating invariants can, in principle, be reduced to dn2 + 1. Indeed, when the group action is on a vector space of dimension m, taking m + 1 “random” linear combinations of any finite generating set will result (with probability 1) in a small generating set. However, as we start with an exponential number of generators above, this procedure is both inefficient and also not explicit (it is not clear how to make it deterministic). One can get an explicit generating set of minimal size deterministically using the Gröbnerbasis algorithm (see [MR11] for the best known complexity bounds) but this will take doubly exponential time in n. The works above [Mul12b, FS13] reduce this complexity to polynomial time! This happened in two stages. First Mulmuley [Mul12b] gave a probabilistic polynomial-time algorithm, by cleverly using the structure of the exponentially many invariants above (using which one can obtain sufficiently random linear combinations using only polynomially many random bits and in polynomial time). He then argues that using conditional derandomization results, of the nature discussed

199We will not elaborate on the theory of quivers representation here, but only remark that reductions and completeness occur in this study as well! The left-Right quiver is complete in a well deﬁned sense (see [DM15], Section 5). Informally, this means understanding its (semi)-invariants implies the same understanding of the (semi)-invariants of all acyclic quivers. 200Convince yourself that such polynomials are indeed invariant. 201We remark that this is the same foundational paper which proved the ﬁnite basis and Nullstellensatz theorems. It is interesting that Hilbert’s initial motivation to formulate and prove these cornerstones of commutative algebra was the search for invariants of linear actions.

175 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

in Section 7.2, one can derive a deterministic polynomial-time algorithm under natural computational hardness assumptions. Shortly afterwards, Forbes and Shpilka [FS13] showed that how de-randomized a variant of Mulmuley’s algorithm without any unproven assumption, yielding an unconditional deterministic polynomial-time algorithm for the problem! Their algorithm uses the derandomization methodology: very roughly speaking, they first notice that Mulmuley’s probabilistic algorithm can be implemented by a very restricted computational model (a certain read-once branching program), and then use an efficient pseudo-random generator for this computational model. Here is one important algorithmic corollary (which can be extended to other quivers). Theorem 13.24 [Mul12b, FS13] There is a deterministic polynomial-time algorithm to solve the following problem. Given two tuples of rational matrices (A1,A2,...,Ad), (B1,B2,...,Bd),, determine if the closure of their orbits under simultaneous conjugation intersect. It is interesting to remark that if we only consider the orbits themselves (as opposed to their −1 closure), namely ask if there is Z ∈ SLn(F) such that for all i ∈ [d] we have Z AiZ = Bi, this becomes the module isomorphism problem over F. For this important problem there is a deterministic algorithm (of a very different nature than above, using other algebraic tools) that can solve the problem over any field F using only a polynomial number of arithmetic operations over F [BL08].

13.9.3 Left-Right action

Consider now the following action of two copies, SLn(F) × SLn(F) on d-tuples of n × n matrices. 2 We still have m = dn variables arranged as d n × n matrices X = (X1,X2,...,Xd). The action of a pair of matrices Z,W ∈ SLn(F) on this tuple is by left-right action, transforming it to the −1 −1 −1 tuple (Z X1W, Z X2W, ··· ,Z XdW ). Again, for this action, is which polynomials in the variables X are invariant under this action? Despite the superficial similarity to the to simultaneous conjugation, the invariants here have entirely different structure, and bounding their size required different arguments. The works of [DW00, DZ01, SVdB01, ANS10] provide an infinite set of generating invariants. The generators (again, over algebraically closed fields) are determinants of linear forms of the d matrices, with matrix coefficients of arbitrary dimension. Namely the set

{det(C1 ⊗ X1 + C2 ⊗ X2 + ··· + Cd ⊗ Xd): Ci ∈ Mk(F), k ∈ N}. These generators, while concisely described, fall short on most goodness aspects above, and we now discuss improvements. First, by Hilbert’s finite generation, we know in particular that some finite bound k on the dimension of the matrix coefficients Ci exist. A quadratic upper bound k ≤ n2 was obtained by Derksen and Makam [DM15] after a long sequence of improvements described there. Still, there is an exponential number202 of possible matrix coefficients of this size which can be described explicitly, and allowing randomness one can further reduce this number to a polynomial. Thus we e.g. have the following weaker analog to the theorem above regarding orbit closure intersection for this left-right action. Theorem 13.25. There is a probabilistic polynomial-time algorithm to solve the following problem. Given two tuples of rational matrices (A1,A2,...,Ad), (B1,B2,...,Bd), determine if the closure of their orbits under the left-right action intersect.

202Well, a possible inﬁnite number, but it can be reduced to exponential.

176 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

In the remainder we discuss an important special case of this problem, namely when all Bi = 0, for which a deterministic polynomial-time algorithm was found. While this problem is in commutative algebra, this algorithm surprisingly has implications in analysis and non-commutative algebra, and beyond to computational complexity and quantum information theory. We will mention some of these, but let us start by defining the problem. For an action of a linear group G on a vector space V , define the nullcone of the action to be the set of all points v ∈ V such that the the closure of the orbit Gv contains 0. The points in the nullcone are sometimes called unstable. The nullcone of fundamental importance in invariant theory! Some examples of nullcones for actions we have discussed are the following. For the action of SLn(C) on Mn(C) by left multiplication, it is the set of singular matrices. For the action of SLn(C) on Mn(C) by conjugation, it is the set of nilpotent matrices. As you would guess (one direction is trivial), the nullcone is precisely the set of points which vanish under all invariant polynomials. Thus if we have a good generating set one can use them to efficiently test membership in the nullcone. However, we are not in this situation for the left-right action. Despite that a deterministic polynomial-time algorithm was obtained in [GGOW15] over the complex numbers, and then a very different algorithm by [IQS15] which works for all fields. These two algorithms have different nature and properties, and use in different ways the upper bounds on the dimension of matrix coefficients in the invariants. Theorem 13.26 [GGOW15, IQS15] There is a deterministic polynomial-time algorithm, that on a given a tuple of matrices (A1,A2,...,Ad) in Mn(F) determines if it is in the nullcone of the left-right action. We conclude with some of the diverse consequences of this algorithm. All the precise definitions of the notions below, as well as the proofs, interconnections and the meandering story leading to these algorithms can be found in [GGOW15, GGOW16]. Theorem 13.27 [GGOW15, GGOW16] There are deterministic polynomial-time algorithms to solve the following problems.

• The feasibility problem for Brascamp-Lieb ineuqalities, and more generally, computing the optimal constant for each. • The word problem over the (non-commutative) free skew ﬁeld. • Computing the non-commutative rank of a symbolic matrix203.

• Approximating the commutative rank of a symbolic matrix to within a factor of two204. • Testing if a completely positive quantum operator is rank-decreasing.

203A matrix whose entries are linear forms in a set of variables 204Computing this rank exactly is the PIT problem discussed at the end of Section 12.4.

177 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

14 Space complexity: modeling limited memory

Despite remarkable technological advances in miniaturizing computer memory (we are accustomed to carrying gigabytes of movies, pictures and music in our pockets), space is a costly resource whose minimization is of importance in numerous applications, especially those dealing with “big data”. One important message of this short section is that surprising things can be done with very little memory! We start with describing the basic computational model of space bounded algorithms, the main complexity classes studied, and some of the most basic results and open problems from the classical theory of space complexity. Then, to demonstrate the power of small space computation we proceed in two frameworks. In the first we discuss the more modern streaming model of space-bounded computation, in which huge amount of data “flies by”, to be seen only once. Still, methods to “condense” it allow computing important statistics in small space. In the second we describe two older results about the tiniest possible space, and show counterintuitively, that a fixed amount of memory suffices to count to arbitrarily large numbers!

14.1 Basic space complexity Space complexity is almost as well studied as time complexity (the main resource discussed in this book), and an elaborate complexity theory was developed to study the classes of problems solved by space-bounded algorithms, and their relationship to time and other resource limitations. Indeed, some of these classes and connections have already been mentioned in this book, e.g. the class PSPACE of “strategic problems” defined in Section 4.1, and the fundamental Theorem 10.3 that every problem in this class possesses an interactive proof. Most problems discussed in this book so far are in polynomial space, and a major question is which of them are solvable in much less space, sub-linear, even logarithmic in the input size, or even constant. Modeling computation with so little memory, smaller than the input length, should be defined with care, so that space limitation is restricted precisely to the working space of the algorithm. The standard model simply distinguishes input access from working memory access. Thus, in a space- bounded algorithm (e.g. a Turing machine), the input resides on a read-only tape, which cannot be modified, and the space restriction applies only to a separate tape (or tapes) of “working memory” that have read/write access by the algorithm. Space s(n) captures the class of problems solvable with such algorithms, say Turing machines, that on input of length n use only s(n) bits of their working memory. For problems requiring a long output (longer than the space bound), another separate write-only tape is provided. By far the most important and well studied space-bounded complexity class is L, consisting of problems solvable on O(log n) space. We list here a few basic problems in this class. The reader may want to find such small-space algorithms for them (most are quite simple).

• Arithmetic problems Given two integers, compute their sum, product, and one modulo the other. • Comparison problems Compare two integers, sort a set of integers. • 2-coloring Given a graph, determine if it is bipartite.

• Word problem in the free group [LZ77] Given a sequence from the alphabet {a, a−1, b, b−1}, determine if their product is the identity.

178 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

As for time-bounded complexity, it is natural to extend the space-bounded model to allow probabilistic and nondeterministic computation205. Again, modeling should be done with care. To account for space correctly, the model should specify how the random/guess bits are accessed; it must ensure only one-time access to each such bit (which the algorithm may or may not want to explicitly store in working memory). The two standard (and equivalent) ways of thinking about this mechanism are (1) allowing the machine to have random/guess states that generate one coin- toss/guess-bit at a time, or (2) have all coin-tosses/guess-bits written on a separate tape which can be read from left to right (and so each bit is accessed once). This limited access to randomness or non-determinism will play a crucial role in the weakness of these models we discuss below, as compared to their time-bounded analogs. The probabilistic and non-deterministic analogs of L are denoted BPL (probabilistic log-space, analogous to BPP), and NL (nondeterministic log-space, analogous to NP), respectively. The basic observations that space upper bounds time, while time is never more than exponential in space, result in the following chain of inclusions between time and space classes.

L ⊆ N L ⊆ P ⊆ N P ⊆ PSPACE ⊆ EX P Just as more time buys more computational power (and e.g. P= 6 EXP), more space buys more computational power (and e.g. L= 6 PSPACE). These separations imply that some of the immediate inclusions above are strict, but we have no idea which. To a large extent, space complexity is much better understood than time complexity. Let us mention a few such fundamental results and their intuitive meanings (without formally defining the related classes). Most of them are much easier to understand simply as low space algorithms for the following two variants, directed and undirected, of the graph connectivity problem. The problems DCONN and UCONN are defined as follows. In both, the input is a graph G, together with two special nodes marked s and t, and the problem is to determine if there is a path in G from s to t. The only difference is that in DCONN the input graph is directed, and in UCONN it is undirected. DCONN plays for N L the role that SAT plays for NP; it is a complete problem for this class. Of course, an appropriate notion of reduction has to be defined; here log-space reductions replace polytime reductions. The completeness of DCONN follows simply from the fact that in the computation of a log-space machine there are only polynomially many different configurations, and transitions between them on a given input is naturally described by a directed graph. An input is accepted if and only if an accepting configuration is reachable from the initial configuration. The simple fact that DCONN has a polynomial-time algorithm explains the inclusion N L ⊆ P above. The undirected version UCONN too played an important role as a complete problem for a class called SL, by a similar argument to the one above. It was one of the important examples of problems in BPL; but as we’ll see below, this problem, and this class, are less special today due to Theorem 14.3 below. We start with two upper bounds on the power of nondeterminism (or guessing) in the log-space regime. We remind the reader that the analogous results for time complexity are not known, indeed are not believed. The first, one of the oldest results in complexity theory, due to Savitch [Sav70], is the analog of P = NP. Here non-determinism can be eliminated at a quadratic blow-up in space. This is achieved by showing that DCONN, the complete problem for NL, can be solved deterministically using only (log n)2 space. Below we use the notation Lt to denote problems solvable by a deterministic algorithm using space (log n)t for any rational t.

205As well as alternating, interactive, quantum, etc., which we will not discuss

179 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Theorem 14.1 [Sav70] N L ⊆ L2. The next result, independently due to Immerman [Imm88] and Szelepcsényi [Sze88] is a strong analog of NP = coNP for space complexity. It says that existential and universal quantifiers can be exchanged at only linear cost in space. Equivalently, there is a deterministic log-space algorithm for the following task; it receives a directed graph as input, and produces another as output, such that one has an s − t path if and only if the other one doesn’t! A hint, for those who rise to the challenge of finding such an algorithm, it hinges on counting the number of paths from one node to another. Theorem 14.2 [Imm88, Sze88] NL = coNL. We next move to undirected connectivity. A breakthrough result of Reingold [Rei08] is a deterministic log-space algorithm for UCONN. This is one of the most sophisticated graph algorithms in existence, using expander graphs and pseudo-randomness in essential and surprising ways. More abstractly, the theorem says that symmetric non-determinism adds no power for space bounded algorithms. Theorem 14.3 [Rei08] SL = L. We conclude with the (very low) cost of removing randomness from space bounded algorithms, namely de-randomizing BPL. It all started with the seminal construction of an unconditional pseudo-random generator for probabilistic space-bounded computation of Nisan [Nis92] below. Stressing again, unlike for time-complexity (compare with Theorems 7.13, 7.14 in Section 7.3), there is no hardness assumption here! Indirectly however, as should be expected by the connection between pseudo-randomness and hardness, at the heart of Nisan’s construction is a provable lower bound (see more at the end of the next subsection)! To state the theorem, we note that pseudo- randomness for space is defined in the same way we defined it for time, but taking into account the 1-way access of randomness in space bounded computation. We say that a distribution on n bits fools a log-space machine if 1-way access to its bits cannot be distinguished (say with advantage 1/poly(n)) from 1-way access to the uniform distribution on n bits. Theorem 14.4 [Nis92] There is a log-space computable generator G : {0, 1}m → {0, 1}n, with m = O((log n)2), which fools log-space computations. Both theorems below follow by utilizing, in very different ways, Nisan’s generator above. Both may be viewed as (incomparable) analogs to BPP = P. In the first result, the class SC contains all problems which can be solved by a deterministic algorithm of polynomial time and polylogarithmic space. Theorem 14.5 [Nis94] BPL ⊆ SC. Theorem 14.6 [SZ99] BPL ⊆ L3/2. From what we know, let’s move to what we want to know. Perhaps the most outstanding questions in basic space complexity is the exact power of randomness and non-determinism in this model. The following conjectures reflect the popular belief that randomness adds no power at all, while non-determinism does. Conjecture 14.7. BPL = L

An elegant “complete” variant of a graph connectivity problem for which a log-space algorithm will prove this conjecture is given in [RTV06].

180 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Conjecture 14.8. N L 6= L.

Algorithmically, this conjecture states that DCONN does not have a deterministic log-space algorithm, unlike its undirected sibling UCONN! As things stand, we know no natural function (say in NP) which requires more than logarithmic space to compute. Recall that we also know no natural function that requires more than linear time to compute. It was thus a bombshell when Fortnow [For00] gave a very simple proof that SAT , the most basic NP-complete problem, is hard in the senses above for at least one of space or time. Indeed, the result is far stronger: algorithms which use near-linear time must use almost linear space! Theorem 14.9 [For00,FLvMV05] For every fixed > 0 there exist δ > 0, such that any algorithm solving SAT which uses n1− space, requires time at least n1+δ. Results of this nature are called time-space trade-offs, and are known for several other models besides Turing machines, both uniform and non-uniform. We will discuss another such trade-off in Section 15.2.2. Also see [BSSV03] and its historical overview.

14.2 Streaming and Sketching An exciting and challenging space-limited model, whose importance continually grows due to big data applications, is the streaming model (see the surveys [Mut05,Cor11,McG14]). Unlike classical space-bounded models that allow multiple access to the input, here the input “flies by” and what is not stored (in the limited space which is far smaller than the input length) is gone forever. An example which is often cited to demonstrate situations motivating such a model is the experiments at the Large Hadron Collider (LHC) in Switzerland, recently famed for establishing the existence of the Higgs boson. Almost all of the enormous amount of data registered by the LHC detectors from the debris of the high energy collisions in this accelerator are discarded instantaneously for lack of space, and only a tiny amount is kept; the sophisticated algorithms used attempt to keep only information essential to the discovery of new phenomena. Needless to say, streams of vast amounts of data arise in numerous other experiments and observations in astronomy, biology and other sciences, as well as the observation of Internet traffic, financial information, weather and more. In almost all cases, only essential statistical or structural information about the data is required. A down-to-earth example, among the first motivating ones for this field, is the following. As- sume the input passing by is x = (x1, x2, . . . xn) with each xi being an element in the range [n] = {1, 2, . . . n}. A basic question is how many distinct elements were in x. Of course, with linear O(n) space one can store x and answer this question, but what can be done if space is sublinear? It is pretty clear (but needs a proof) that it is impossible to solve this problem exactly and deterministically, and indeed most algorithms in this field allow both approximation and randomization. For example, for the problem above, what do you think is the minimal amount of space needed to give, with probability at least 99%, an estimate within 1% of the correct number of distinct elements? The answer is surprisingly small: O(log n) bits suffice for such a high quality estimate with such high confidence. Such an algorithm was discovered by Alon, Matias and Szegedy [AMS96], and the reader is invited to try and find any sublinear space one. Indeed, [AMS96] and future papers studied such algorithms for computing other “frequency moments” of the distribution x. More precisely, the input x defines a histogram h = (h1, h2, . . . hn) where hi counts the number of xj having the value i. The number of distinct elements of x is

181 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

simply the number of nonzero entries of h, or in other words, the “0-norm” of h denoted |h|0. One of the most valuable statistical information about such numeric data is other norms (or moments) |h|p of h, or the entropy of this distribution, etc. As it happens, some can be estimated accurately in small space and others cannot, where both upper and lower bounds on space often require quite sophisticated techniques and lead to interesting connections (e.g. to topics like stable distributions, metric embeddings, sparse recovery and more). The most common method used in streaming algorithms is the maintenance of a sketch (or fingerprint), a small space data structure which captures a sufficient amount of information about the part of the input seen so far, which is easy to update at the arrival of a new data item. Needless to say, finding an appropriate sketch for a given problem is highly nontrivial. Much more on streaming and sketching, for these and other types of problems (e.g. approximating parameters on graphs) can be found in the surveys above. Let us give a (high level) demonstration of a sketch in action. This elegant choice, for approximating the L2 norm of h above, was suggested by Indyk [Ind00]. Again, the reader might consider the challenge of doing so in very small space, a task that looks impossible initially, before reading on. Here is the algorithm. Before seeing the input, we pick once and for all a random sign vector in v ∈ {−1, 1}n. The sketch will be a single integer z, initialized at 0. It will be updated with each arrival of an input xi as follows: if xi = j we simply add vj to z. It is easy to see by linearity that at the end of this algorithm, the value of z is simply the inner product of v and h. As v was a random 2 2 sign vector, the expectation of z is |h|2, and moreover it is highly concentrated around its mean. So, to get an accurate estimate with high probability one applies the usual trick: maintain a few independent vectors v and sketches z for each, and at the end of the algorithm report their median value. Note that each of the z counters requires only O(log n) space! Are we done? Wait (I hear you say)—what about the random vectors v? Storing them requires linear space! Actually it does not—Indyk shows in his paper how to use Nisan’s space pseudo-random generator of Theorem 14.4 to generate and store good enough alternative vectors using only O(log n)2 space, giving yet another application of the de-randomization quest discussed in Chapter7. Even from this simple example a few consequences about the streaming and sketching “way of thinking” are evident. One is that a sketch can provide a high accuracy estimate not only at the end of the input, but actually throughout its arrival, after every new symbol is added. Thus, the input length need not be fixed in advance, and can be viewed as infinite. Another is that the input may be viewed differently than some raw data from a scientific observation. For example it may be a sequence of updates to an object, e.g. a network in which certain links and nodes are lost or added over time, and a sketch may capture various connectivity properties of the network. Thus sketches give rise to new data structures for dynamic problems in which the input undergoes changes with time. Let’s conclude with a simple streaming task that cannot be solved in small space; indeed it is the very problem on which Nisan’s pseudo-random generator in Theorem 14.4 is based. Two random sequences, first x and then y, of length 10s each, fly by, and the task is computing their inner product modulo 2. Try proving that the probability of a space s algorithm to guess that inner 1 −s product cannot exceed the trivial 2 by more than 2 . Such lower bounds often use communication complexity, the topic of Chapter 15, where we further discuss Nisan’s generator.

14.3 Finite automata and counting The most severe restriction on memory is to bound it by an absolute constant, independent of input size. This subsection illustrates that even such a limited model has surprising power, which

182 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

in turn demonstrates an important point: some lower bounds may be hard to prove for the simple reason that they are false: the two algorithms below were discovered when attempting to prove they do not exist. We will also see that the power of this very weak computational model is far from completely understood; indeed some of the open questions regarding it are closely related to questions on standard space complexity classes discussed above. The “impossible” task which demonstrates this power is the basic problem of counting. It is not hard to show that counting arbitrarily high is impossible with a fixed amount of memory. This intuition seems to extend to the finite-memory devices which can toss random coins, or obtain some input-independent “advice” (please check if you believe these intuitive statements). But we will see that in both cases, a few bits of memory (say ten) suffice to determine if a binary sequence of any length has more 1’s than 0’s (with high probability, say 2/3, in the probabilistic setting). Let us describe the computational model a bit more conveniently. When the working space s(n) of a Turing machine is of constant size (namely independent of the input size n), it can be simply viewed as part of the finite control of the machine. In other words, the Turing machine becomes a finite automaton. Finite automata played an important role in the history of the computer science. Formal definitions and central results as well as their role in the early development of computation theory, can be found in Sipser’s excellent textbook [Sip97]. We start with 2-way deterministic finite automaton (2DFA), which is precisely a Turing machine with constant space. The 2-way stresses that the input tape can be scanned in both directions (like a Turing machine, but in contrast to other automata we shall soon meet). A finite automaton has a finite control (or program) that is captured by a finite number of states. The automaton is initially at some starting state, with its reading head on the (say) left input symbol. At each step the cell contents and the current state determine the next state of the automaton (if it enters Accept or Reject state, then it halts), and if the head moves left or right (we assume that the left and right endpoints of the input are detectable). Summarizing, a 2-DFA is simply a Turing machine without the ability to write. A 2DFA cannot count! Consider the Majority function, which for a binary sequence computes if it has more 1’s than 0’s. Try proving that a 2DFA with n states cannot compute Majority even for sequences of length 2n. So, we will enhance our 2DFA with extra capabilities as discussed above. Thus, let us thus try to add power or extra capabilities to our finite automata: nondeterminism, alternation, randomness and advice, and discover the origins of this activity, so fundamental to our field as we have seen throughout this book. But before starting, let us discuss 1DFA, the older sibling of 2DFA. This model was defined by Kleene [Kle51], to understand the “Nerve Nets” of McCulloch and Pitts [MP43], the first mathematical model of neurons and the brain. Kleene proved that 1DFAs compute precisely regular languages: sets of sequences possessing strong periodicity structure206. This characterization easily implies that Majority is not a regular language, and cannot be computed by 1DFAs. The first to systematically explore the relative power of different finite automata models with different capabilities were Rabin and Scott, in their seminal paper [RS59], which set an example for many later studies of other computational models. In particular, Rabin and Scott [RS59] defined 2DFAs, and one of their major results was that for deterministic computation, the two models are equal in power207. This proves that 2DFAs, like 1DFAs, compute exactly the regular languages.

206A regular language S (over an alphabet Σ) is either a finite set of sequences over Σ, or can be obtained from previously defined languages as a the union of two, S = S1 ∪ S1, the concatenation of two, S = S1S2 (concatenating ∗ any sequence of S1 to one in S2, or the Kleene star of one, S = S1 , namely a concatenation of any finite number of sequences of S1. 207This is far from obvious, as a 2DFA can access the input bits arbitrarily many times, whereas a 1DFA sees each

183 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

And in particular, 2DFAs cannot compute Majority either. In the same paper, Rabin and Scott suggested adding nondeterminism to the model (this inspired the later addition of nondeterminism to Turing machines, e.g. when extending P to NP), by allowing several possible transitions from each given state and cell contents. They also proved that the resulting model, called 2NFA, cannot compute more sets than its deterministic sibling208. The model was further extended to allow alternation (in the same way the single existential quantifier in NP is extended to alternating existential and universal quantifiers in the definition of the polynomial time hierarchy PH) in [LLS84]. They proved however that even this model, called 2AFA, still computes no more sets than 2DFA, namely only regular languages. Summarizing, starting with the weakest deterministic one-way automaton, 1DFA, and upgrading it with 2-way input access, nondeterminism and even alternation, does not increase the computational power. So, we turn to adding randomness to the models, creating respectively 1PFA and 2-PFA for one- way and two-way Probabilistic Finite Automata. As in Turing machines, these models are allowed to toss perfect random coins and use them in computation (namely, take a random transition between states), and are required to compute the correct answer with high probability (say 2/3) on every input. Can this model do more than all others above? The results just mentioned seem to hint that if space is constant, then it is hard to utilize extra capabilities, like nondeterminism and alternation. Furthermore, in the 1-way model, Rabin [Rab63] proved that 1PFA cannot do more than 1DFA, so adding randomness does not help in that setting either: 1PFA can only compute regular languages. It thus came as a surprise when Freivalds [Fre81] proved that 2-way probabilistic finite automata are stronger! In particular, 2PFAs can count arbitrarily high. Theorem 14.10 [Fre81] There is a 10-state 2PFA which computes Majority with probability ≥ 2/3 on every input. Moreover, for every > 0 there is an integer c = c() and a c-state 2PFA which computes Majority with probability ≥ 1 − for every input. We will explain the simple idea behind this algorithm at the end of the section, leaving you time and space to try and figure it out yourself. We proceed to add a different feature to 2-way automata: non-uniformity. Non-uniformity was discussed in Chapter5. There, the non-uniform model of Boolean circuits was shown equivalent to the uniform Turing machines when equipped with (input-independent) advice. More specifically, there and here, we allow the machine, when given an input of length n, to have (read-only) access to an external (advice) tape of some fixed polynomial length in n. Such a non-uniform machine computes a function if for every n there exists a binary (advice) sequence αn, which if resides in the advice tape, causes the machine to give a correct answer on every length n input (no requirement is made if the advice tape contains any other string). Note that the advice sequences αn can of course depend on the function computed, but being so short, cannot contain the answer to every possible input of length n. In accordance with our notation in Chapter5, we denote this model 2DFA/poly (but the more common name is “constant-width branching programs”). So, what good can a sequence of length n10 do you, if you have only ten (or even a million) bits of memory, and are required to compute Majority on an arbitrary sequence of n bits, for arbitrarily input bit for one step, and then it is gone. Try proving it! 208They actually proved it for 1NFA, simulating it by a 1DFA, but the same proof works for 2NFA. We note that this simulation of non-deterministic automata by deterministic ones incurs exponential blow-up in the number of states. This is known to be tight for 1NFA, but it completely open for 2NFA. Indeed, proving a super-polynomial lower bound on the number of states in such a simulation will prove Conjecture 14.8 above. See [Pig13] for a survey of this approach.

184 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

large n? The community working on this problem was unanimous that such short advice is useless, and that in fact an exponential lower bound on the length of the advice string should not be difficult to prove (indeed, such a lower bound was proved if the machine has only 1 bit of memory). It thus came as a shock when Barrington (who was trying to prove such a lower bound) announced that this task is possible [Bar86]. Indeed, Majority can be computed in this model with only 3 bits of memory! And many other functions as well! Theorem 14.11 [Bar86] There is a 5-state 2PFA/poly which computes the Majority function. Indeed, the same holds for every function computed by a polynomial-size Boolean formula. I suspect that this proof (which is short and sweet) will be harder to rediscover than the previous one, so let me give you a few hints. A significant hint, and the main insight of the proof, is using in an essential way a non-solvable group (the number 5 of states is related to the alternating group on 5 letters being the smallest non-solvable permutation group). Another related hint is that the automaton constructed is reversible (not only is the next configuration uniquely determined from the previous one given the input symbol read, as in any deterministic machine, but also the previous is determined from the next). Finally, don’t try to prove the first statement about majority, but rather the second, as it allows induction on the structure of the formula computed. The advice used by the 2PFA should be interpreted as a sequence of which input bits to be read at what step; the length of the advice sequence is quadratic in the formula size. Let me add two more comments about this remarkable result. First, it inspired an analogous result for arithmetic computation, showing how to evaluate an arithmetic formulas with a constant number of registers (indeed, three suffice) [BOC92]. Second, the reversibility aspect of formula evaluation was critical to many uses of the theorem above in cryptography, starting with [GMW87, Kil88]. Now let’s return to probabilistic automata, and conclude with the idea behind Freivalds’ Theo- rem 14.10. You have (say) 10 bits of memory, and a coin to toss. Presented with a binary sequence (say for simplicity of odd length), scan it from left to right and perform the following “tournament” between the 0’s and 1’s you observe. Toss a coin for every bit you see, and separately record if it came up Heads for all 0s (call this event W0), or if it came up Heads for all 1’s (call this event W1). This requires only one bit of memory each. If neither or both events happened, repeat this tournament again (this decision requires a couple more bits of memory). If exactly one happened, declare that one as the loser (namely, if W0 happened output that there is a majority of 1’s, and vice versa). The analysis is easy: the probability of the event for the minority bit is at least twice as high as the one for the majority bit, and so this algorithm will be correct with probability 2/3. To boost the success probability, and prove the 2nd part of the theorem, simply toss t coins per input bit. This will require t extra states, but will boost the ratio between the probability of the two events from 2 to 2t. The observant reader will have noticed a few unsatisfactory properties of this algorithm. For one, it may never halt. This is necessary; indeed, a 2PFA that always halts computes only regular languages, as proved in the original paper [Fre81]. Of course, with probability 1 it does halt, but in expected exponential time. This too is necessary; Dwork and Stockmeyer [DS90] proved that if a 2PFA halts in expected polynomial time, then it computes only regular languages. An intriguing question which remains open is the power of this probabilistic polynomial time, constant space model in the interactive proof setting, namely, when the 2-way automata are allowed both randomness and non-deterministic transitions. Does this model only compute regular languages? This question was raised in [DS92], and further progress towards it was made in [CHPW98].

185 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

15 Communication complexity: modeling information bottlenecks

This field of communication complexity studies the communication costs of computing discrete functions whose input is split between two parties. It was born in 1979 with a paper by Yao [Yao79], following similar work of Abelson on continuous functions. The field grew rapidly, both mathematically and applications-wise, and the comprehensive book of Kushilevitz and Nisan [KN97] covers the first two decades of activity. Today, two decades after that book was published, there is a dire need of a new book summarizing the amazing work that has been done since, with some very recent breakthroughs, solutions to very old problems and exciting new directions. The purpose of this section is not to summarize all that, but rather focus on a single feature of the communication complexity model: its versatility. When I was a student, I witnessed a conversation between another student and Andy Yao regarding this model. Frustrated that Yao’s original paper gives almost no motivation, the student asked him why computer scientists should study such a simple, stylized model, which is purely information theoretic and in particular ignores all computational aspects. Yao’s answer was simple: because it is basic. To me, starting a career in research, this answer was a lesson for life. The ensuing discoveries of many diverse computational settings to which this model provides crucial insight reaffirms this lesson again and again. In this section we’ll see these applications, to VLSI design, auction theory, circuit complexity, linear programming, pseudo-randomness, data structures and more. Needless to say, communication is an important computational resource in distributed systems—but in some of these applications we will see that through simple or subtle reductions it informs us about other computational resources like time, space, size, randomness, queries, chip area and more. Not surprisingly, in nearly all cases, the proof proceeds by a reduction, which has the following nature: A model of computation which uses too little of a given resource (or combination of resources) to compute a given function, is shown to exhibit a communication bottleneck, that allows converting this computation into a cheap communication protocol for a related communication task. After all that, I will not resist describing some new exciting and fundamental work which actually further pursues the connections of communication complexity with information and coding theory: compression and error correction of communication protocols.

15.1 Basic definitions and results We give here a very short overview of some basic aspects of communication complexity, aiming at simplicity rather than generality, and at results we shall use in the applications below. As mentioned, a comprehensive text for its day is [KN97], and some more recent excellent surveys on different aspects of this growing field include [She14, Lov14, Rou16]. We present here only Yao’s basic model. In the bullets on different applications below we will see how each plays a different variation on this simple basic theme. A communication problem is simply a 2-argument function, f : X × Y → Z, where X,Y and Z are finite sets. An input x ∈ X is given to Alice, and an input y ∈ Y is given to Bob. Together, they should both compute f(x, y) by exchanging bits of information in turn, according to a pre- agreed on protocol. There is no restriction on their computational power; the only measure we care to minimize is communication cost. We formalize these notions below, first for deterministic protocols and then for probabilistic ones. In the spirit of computational complexity theory other “modes” beyond deterministic and probabilistic were borrowed from Turing machines and adapted

186 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

to the communication model, including nondeterministic, alternating, quantum, Arthur-Merlin and others. Indeed, Babai, Frankl and Simon [BFS86] initiated the definitions and systematic study of the related complexity classes. We will not discuss these extensions here. A deterministic protocol specifies for each of the two players the bit to send next, as a function of their input and history of the communication so far, as well as the output at termination. It can be naturally described as a binary tree, where internal vertices are labeled by Boolean functions on X or Y (depending whose turn it is to speak at this node), and the leaves are labeled by the output value (in Z). The communication complexity (or cost) of a protocol is simply its depth (which counts the maximum number of bits exchanged on any input). It computes a function f if for every input pair (x, y) the path followed by the players’ communication on this input arrives at a leaf labeled f(x, y). The deterministic communication complexity of a communication function f is the cost of the cheapest protocol computing it. We denote this quantity D(f). A convenient way to view a communication function f is as a matrix Mf whose rows are labeled by elements of X, columns labeled by elements of Y , and the (x, y) entry is f(x, y). It is convenient to understand the effect of communication protocols on this matrix. A basic insight is that when the first bit is sent, say from Alice to Bob, its value partitions the rows X (Alice’s possible inputs) in two parts, creating a submatrix on which they proceed. In it, Bob’s next bit to Alice partitions Y etc. As this process continues, we see that every c-bit protocol induces a partition of the matrix c Mf into (at most) 2 “combinatorial rectangles”, where a rectangle is simply a cartesian product of a subset X0 ⊆ X and Y 0 ⊆ Y . Moreover, if the protocol computes f then all rectangles in this partition are monochromatic, namely labeled by a unique element of Z. This insight is the source of all deterministic lower bounds. An especially useful observation, due to Mehlhorn and Schmidt [MS82], is that if we view Z as a subset of a field K, then D(f) ≥ log rkK (Mf ), where 209 rkK denotes the rank function in this field . Another useful observation we shall soon use is that when the matrix is triangular with a nonzero diagonal, its rank is full. Let us look at a few examples of natural functions, some of which will show up below, and gain some intuition about the model. In all cases we take X = Y = {0, 1}n and Z = {0, 1}. Communication complexity is measured as a function of the input size n. Note from the outset that in this model n+1 is an upper bound on the communication complexity of every communication function (as one of them can send its input to the other, who will compute the answer and send it back).

1. Equality: EQ(x, y) = 1 iﬀ x = y. 2. Greater-or-Equal: GE(x, y) = 1 iﬀ x ≥ y.

210 3. Disjointness : DISJ(x, y) = 0 iﬀ for some i, xi = yi = 1.

It is easy to see that for all three functions, their matrices are triangular211 with 1’s on the diagonal, and so by the above rank lower bound they all have essentially maximal deterministic communication complexity.

Fact 15.1. 209How tight this lower bound is in general is the subject of the notorious log-rank conjecture, see [Lov14] for history and state-of-art. 210Here x, y are viewed as characteristic vectors of subsets of [n]. 211for disjointness it is the bottom right of the matrix which is all zeros, when rows and columns are sorted lexicographically.

187 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

1. D(EQ) ≥ n 2. D(GE) ≥ n 3. D(DISJ) ≥ n We now allow the players to toss coins, which adds considerable power (sometimes). A probabilistic protocol is simply a distribution over deterministic protocols212. Its cost is the maximum depth of any tree in the support of this distribution. Such a protocol computes a function f with error if for every input pair (x, y), the probability that a random protocol from this distribution reaches a leaf labeled f(x, y) is at least 1 − . As before, the probabilistic communication complexity of a communication function f is the cost of the cheapest probabilistic protocol computing it in 1 this sense. We denote this quantity R(f). In most cases we pick = 3 , and let R(f) = R(f) (error reduction can be achieved by independent repetition, as in probabilistic algorithms). Lower bounds on probabilistic communication complexity, which are extremely useful in many applications, typically demand much more sophisticated techniques; some of these and their relative power are discussed in [KMSY14,LS +09]. The probabilistic communication complexity of the three functions above, which were equivalent in the eyes of the deterministic model, turn out to be very diﬀerent from each other. Theorem 15.2. 1. R(EQ) = O(1) 2. R(GE) = Θ(log n) (e.g. see [Vio15])

3. R(DISJ) = Θ(n) [KS92, Raz92, BYJKS02] The upper bounds in these theorems are very simple, and highlight the importance of hashing in randomized protocols. For example, for the first result on EQ, assume Alice has x, Bob has y and they share a common random sequence r, all of length n. Then hx, ri and hy, ri provide 1-bit 1 hash values of x, y resp., which are always equal if x = y, and are different with probability 2 if x 6= y. For the second result on GE, one can use the same hashing idea on segments of the two inputs in order to discover, via binary search, the most significant bit on which x and y differ, thus determining which is bigger. Of course, for the third, the upper bound is trivial. The lower bounds merit a longer discussion. Probabilistic lower bounds are typically much harder to prove, and are much more useful in applications. The first step in almost all such proofs (as well as for many other types of probabilistic algorithms) follows the so-called Yao’s minimax principle [Yao77], namely considering the following dual question. Rather than focusing on the best probabilistic protocol for a worst-case input, we focus on the best deterministic protocol for an average-case input. This allows proving a lower bound on deterministic protocols, when the input is chosen at random according to some distribution. More precisely, let µ be any distribution on X×Y . The distributional communication complexity of a function f under distribution µ with error , denoted Cµ,(f), is the number of bits in a protocol which computes f(x, y) correctly with probability 1 − , when (x, y) are drawn according to µ. It is easy to see that for every distribution µ we have a lower bound R(f) ≥ Cµ,(f).

212This is sometimes called the shared randomness model (which samples for both players the protocol to use). A private randomness model (in which each player tosses its own coins) is also used, but the two diﬀer very slightly in complexity, within additive O(log n)[New91].

188 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Moreover, as Yao [Yao77] points out, equality is satisfied for some distribution µ∗, which achieves R(f) = Cµ∗,(f) ; this set up is simply a special case of von Neumann’s minimax theorem for zero- sum games [vN28]. Thus any distribution will give a lower bound, and there is no loss of generality in this approach as some distribution will give an optimal lower bound. Again we suppress when 1 setting it equal to , namely we denote Cµ(f) = C 1 (f). 3 µ, 3 Choosing a good distribution is not an obvious matter. Let us consider the lower bounds above. For the second one on GE, picking µ = µX × µY to be any product distribution (in which x and 213 y are chosen independently) will lead to CµX ×µY (GE) = O(1). However, for a choice of µ 214 which correlates the two inputs (x, y) one gets a tight lower bound Cµ(GE) = Ω(log n)[Vio15]. For the third lower bound on DISJ√ , taking again a product distribution will not suffice; [BFS86] prove that CµX ×µY (DISJ) = O( n log n). A correlated choice µ leads to the optimal result above Cµ(DISJ) = Ω(n). The three (difficult!) proofs in [KS92, Raz92, BYJKS02] are quite different in language and style. But they all follow a similar intuition, and they all have an important feature in common that we shall later use. Namely that the hard distribution they pick for DISJ is supported on pairs of sets which are either disjoint of have a single intersection! We state this important distributional lower bound explicitly. Theorem 15.3 [KS92,Raz92,BYJKS02] There is a distribution215 µ on {0, 1}n ×{0, 1}n, supported on pairs of sequences x, y with at most one coordinate that is 1 in both, such that Cµ(DISJ) = Ω(n). While we motivated distributional communication complexity as a tool to prove probabilistic lower bounds, it is of course interesting in its own right, as there are certainly natural situations when an input distribution is given, or known. At any rate, proving distributional lower bounds, even though we can now assume the protocol is deterministic, is typically difficult! There are many techniques, like the discrepancy bounds, corruption bounds, smooth and relative variants of these, and others. We will not discuss them here, and address one lower bound idea, through direct sum, when we get to discuss information complexity in the last subsection.

15.2 Applications We now describe some of the many models for which information is a bottleneck, and the variants of the basic communication complexity model needed to prove these limitations. We note that some of these and many others appear, in much more detail, in the beautifully written monograph of Roughgarden [Rou16].

15.2.1 VLSI time-area trade-oﬀs VLSI stands for Very Large Scale Integration. This semiconductor-based technology, developed in the 1970s, still dominates the fabrication of integrated circuits, like the ones in the microprocessor chips operating your phones and laptops. Today we can pack billions of transistors on one such microprocessor the size of a postal stamp, which was far from being the case in the early days,

213Please check this at least for the uniform distribution. 214In a simple to guess way: pick uniformly at random an index i ∈ [n], and sequences z ∈ {0, 1}i, w, w0 ∈ {0, 1}n−i, and set x = zw, y = zw0. 215 We describe the distribution µ chosen in [BYJKS02]. Pick pairs of bits (xi, yi) uniformly and independently 1 at random from the set {(0, 0), (0, 1), (1, 0)}. With probability 2 give the players the resulting x, y resp. With 1 probability 2 give the players these inputs but ﬂip the ith coordinate in both to 1, for a randomly chosen i ∈ [n]}.

189 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

but both then and now, ways of utilizing the area of a chip optimally is crucial216. The earliest application of communication complexity (really, before the model was fully formalized) was showing that there is an inherent trade-off between the area of a chip computing a function, and the time it takes to compute it. This important connection is the PhD work of Thompson [Tho79, Tho80], which was later extended in many other works. Let us specify the computational model. To eliminate technology from the discussion, we assume that the computing elements of the chip reside on a grid of unit length, and that sending a bit between neighboring computing elements takes unit time. Each computing element can store a constant number of bits, and in one unit time can compute an arbitrary function of its memory and send a bit to any of its neighbors. The initial placement of input bits is arbitrary, and so is the placement of the output bit(s). The communication complexity measure of a function g we will need will be denoted C(g) (sometimes called the arbitrary partition communication complexity of g), and is defined as follows. Assume g : {0, 1}2n → {0, 1} is a function on 2n bits. Every subset S ⊆ [2n] of size n naturally n n defines a communication function fS : {0, 1} × {0, 1} → {0, 1}, obtained by giving the inputs in S to Alice and those outside S to Bob, and asking them to compute g. Now C(g) is defined as the minimum of the communication complexity D(fS) over all such partitions S. Theorem 15.4 [Tho79] For every function g computed by a chip of area A in time T satisfies AT 2 ≥ (C(g))2. The proof is simple. A geometric argument shows that in any chip of area A, and any subset of its computing elements of size 2n, there must√ be a way to cut the chip to two parts along grid lines, so that the length of the cut is at most A, and that each part contains n elements of the given subset.√ Clearly, if the input bits initially reside in this subset, C(g) bits must flow across the cut, and so AT ≥ C(g). Thompson has used this argument to prove quadratic AT 2 lower bounds for the Fourier transform, which is a multi-output function. However it is easy to see that there are simple functions g with C(g) = Ω(n) (which is the largest possible), yielding AT 2 ≥ n2 lower bounds for such func- tions217. Put differently, a chip with too low AT 2 product gives a communication protocol of too low a cost!

15.2.2 Time-space trade-oﬀs As you may recall, we still have no nontrivial lower bounds on either the time or the space required to compute explicit functions. In a similar vein to the previous bullet we try proving that at least they can’t both be very small at the same time. We now prove a result of this nature, for a model called the oblivious branching program (OBP). Intuitively, an OBP accesses the bits of the input (possibly multiple times) in a ﬁxed order, independent of their value. More precisely, an OBP of space S and time T computes a function h : {0, 1}n → {0, 1} if there is a sequence σ ∈ [n]t and a read-only space s Turing machine, which on input x ∈ {0, 1}n reads the input bits xσ(1), xσ(2), . . . , xσ(t) and outputs the value h(x). The minimal resources for an OBP is constant space and linear time. The following result

216This is a general comment about technology, which explains the (unreasonably short) shelf life of any hi-tech product: as its speed and storage increase, so does the desire to apply it to larger problems (larger input data, ﬁner resolution, etc.). 217Obtaining such functions g (that are hard for any partition), from any communication function f (that are hard for a ﬁxed partition), is done simply by encoding the partition S into g’s input. This only doubles the input length.

190 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

of Alon and Maass [AM88] proves that they cannot be simultaneously achieved for the Majority function, and in particular that for constant space, time Ω(n log n) is necessary. Theorem 15.5 [AM88] For every n, any space S and time T OBP computing the Majority function on n bits satisfies ST ≥ Ω(n log n). We note that the surprising Theorem 14.11, which we describe in Section 14.3218 implies that Majority does have an OBP with constant space and polynomial time, indeed smaller than n5. There is still a large gap between the upper and lower bounds, and getting tighter bounds on the complexity of this basic function would be very interesting. For a natural function that is a bit more complex than Majority, the same paper [AM88] proves a much better time-space trade-off. For simplicity we define this function over a 3-letter alphabet, although it can be made Boolean. Let P alindrome : {0, 1, ∗}n → {0, 1} be the function which is 1 iff the 0, 1 pattern of the input (ignoring the *’s) is a palindrome. Theorem 15.6 [AM88] For every n, any OBP computing the Palindrome function on inputs of length n in space S and time T must satisfy T = Ω(n log(n/S)). In particular, if S = o(n) then T is superlinear. The proof of both theorems uses the same “Ramsey-theoretic” lemma (interesting in its own right and with other applications), which enables embedding a hard communication complexity problem into the computation. Intuitively, every short enough sequence on [n] must have two large subsets whose occurrences alternate few times. Here the length of the sequence will be the time T , which is assumed wlog to be a multiple of n. Lemma 15.7 [AM88] For every n, k, for every sequence σ ∈ [n]nk there exist two disjoint subsets A, B ⊆ [n] such that |A| = |B| = n0 = n/28k and σ contains no k-long subsequence alternating between elements of A and B. Let us see now how a space S OBP (for one function) can give rise to a low communication protocol (for a related function), and use communication lower bounds to derive OBP lower bounds. Observe that if the inputs bits in A are given to Alice, and those in B to Bob, any fixing of the remaining bits to constants defines a function of communication complexity at most Sk (each alternation can be simulated by sending S bits from one player to the other). The two theorems above are now easy to deduce. For the Palindrome function, simply set the inputs outside A, B to *’s, resulting in the equality function on n0 bits (which has communication complexity n0). For the Majority function, set the bits outside A, B to have an equal number of 0’s and 1’s, resulting in the Greater-or-Equal functions on log n0 bits, which has communication complexity log n0. We conclude by reminding the reader that time-space trade-offs for general Turing machines (as opposed to the weaker, oblivious ones considered here), were later proven using completely different methods—see Theorem 14.9.

15.2.3 Formula lower bounds We now show how to use communication complexity arguments to prove lower bounds on the size of Boolean formulæ. This connection was discovered in the paper of Karchmer and Wigderson [KW90]. The basic deﬁnitions and background regarding Boolean formulæ are given in Section 5.2.2, but it suﬃces here to recall that we deal with formulæ over the standard logical connectives {∧, ∨, ¬} (e.g. (x ∨ y¯) ∧ z), and that a monotone formula can’t use negation, namely it can use only {∧, ∨}.

218Where OBPs are viewed as 2-way ﬁnite automata with advice.

191 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Also, a basic result of Spira [Spi71] shows that formulas, and monotone formulas, can always be “balanced”, making their depth logarithmic in their size. The following two (essentially tight) lower bounds follow via the connection above, for the connectivity and perfect matching functions on graphs (which of course are monotone functions). In both, n denotes the number of vertices of the input graph. Theorem 15.8 [KW90] Every monotone formula for testing if a graph is connected requires size nΩ(log n). Theorem 15.9 [RW92] Every monotone formula for testing if a graph has a perfect matching requires size 2Ω(n). To explain the connection to communication complexity, we need to extend the notion of communication problems, from computing functions to computing relations. For finite sets X,Y,Z, a relation F ⊆ X × Y × Z defines a communication problem in which Alice gets as input some x ∈ X, Bob gets y ∈ Y , and they should compute some z ∈ Z satisfying (x, y, z) ∈ F . We will only consider relations for which there is at least one legal answer z for every input pair (x, y). The deterministic communication complexity D(F ), and the probabilistic communication complexity R(F ) of a relation F is defined in the same way it is defined for functions. The key idea in connecting formula complexity to communication complexity is the following association of a communication relation Fg (sometimes called a KW-game) to every Boolean function g. Moreover, if g is monotone one can assign to it another (harder) communication relation mon denoted Fg . We now define both. m mon −1 −1 Say g : {0, 1} → {0, 1}. For both relations, Fg and Fg , set X = g (0) and Y = g (1) and Z = [m]. In other words, in both Alice receives a 0-input of g, Bob receive a 1-input of g, and they should compute an input coordinate (that we will denote as i rather than z) of some variable. The only difference is which indices are legal answers.

• (x, y, i) ∈ Fg iﬀ xi 6= yi

mon • (x, y, i) ∈ Fg iff xi < yi Note that in both relations there is always at least one legal answer for every input pair (x, y). As x and y always have different g values, they must be different and so must have at least one coordinate on which their inputs disagree. Moreover if g is monotone it is easy to see that at least in one coordinate the difference will be in the order dictated. Let us denote by d(g) the depth of the shallowest formula for a function g. Similarly we denote by dmon(g) the depth of the shallowest monotone formula for a monotone function g. The main connection states simply the depth of g and communication complexity of Fg are always equal, and the same holds in the monotone case. Theorem 15.10 [KW90]

• For every function g, d(g) = D(Fg)

mon mon • For every monotone function g, d (g) = D(Fg ) This theorem has a simple inductive proof, and is left as an exercise. In brief, a formula for g and a communication protocol for Fg are two views of the same object. Both are described by binary trees, and the key conceptual diﬀerence (which in some cases makes proving lower bounds

192 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

for protocols easier) is that in formulæ computation is perceived as starting at the leaves and propagating to the root, while in communication protocols the computation is perceived as starting at the root and ending at a leaf. With this connection, and recalling a simple fact219 that formulæ depth is (up to constant) the logarithm of the size, the two theorems above follow from the two below, where communication lower bounds on the associated relations are proved. Let Conn and PM denote respectively the Connectivity and Perfect Matching functions on graphs. Note that for graphs of n vertices the input size of these functions is m = n2. While lower bounds on the deterministic communication complexity suffice, we actually know that they hold even for probabilistic communication, a fact which will come in handy soon. mon 2 Theorem 15.11 [KW90, RW89] R(FConn) = Ω((log n) ) mon Theorem 15.12 [RW92] R(FPM ) = Ω(n) While we will not prove these theorems we wish to address one important point. Given the simplicity of the equivalence between formula depth and communication complexity, one may ask what advantage the communication complexity viewpoint brings. The answer in both cases is different (below) but what is common to both, as well as to other proofs, is simply that we have an arsenal of tools and results in communication complexity whose describing language fits perfectly two communicating players, but is completely obscure if translated to formulæ. These specialize in two different ways for the proofs of the theorems above. For the first lower bound on graph connectivity, essential use is made of the basic fact that in the communication complexity framework we have two inputs while the formula has only one. The proof combines top-down induction with random restriction arguments to prove that the players cannot even solve the problem on “large enough” subsets of their respective inputs. The second lower bound on perfect matching is proved by a direct reduction to the set-disjointness function DISJ discussed in the preliminaries. As the reduction is probabilistic, one needs a lower bound for the randomized communication complexity of this problem obtained in Theorem 15.3, which was luckily discovered shortly before this work. It is hard to imagine using such a result in the context of formulæ, where this disjointness lower bound is meaningless. So far we have seen only monotone lower bounds. How about non-monotone ones? Observing the striking similarity between the monotone and general KW-relation of a given monotone function, it seems likely that a minor modification to a lower bound on a monotone relation can perhaps be “fixed” to provide a non-monotone lower bound. To see that the two are quite different, here is one major feature in which they differ. For every function g on m bits, the randomized communication complexity of Fg is at most 2 log m (this follows from the first√ item Theorem 15.2), whereas for some g, like the perfect matching function above, we saw a m lower bound. Thus in particular, to prove non-monotone lower bounds one cannot use distributional arguments (in which inputs are chosen at random), nor can one use probabilistic reductions to other problems. Hard it might be, but here is a concrete challenge. Prove that if Alice has an n-bit prime, Bob has an n-bit composite, then they have no deterministic O(log n) bit communication protocol to find a coordinate in which their inputs differ. Clearly, proving this implies that testing primality has no polynomial size Boolean formula!

219Via the balancing of binary trees.

193 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

15.2.4 Proof complexity While we will try to make this application self-contained, the reader might want to review Chapter6 on proof complexity, especially section 6.3.2 on the cutting planes proof systems and section 6.4 on the feasible interpolation method. The aim of proof complexity is to show that natural propositional tautologies require long proofs in natural proof systems. For simplicity, we define everything here semantically, even though syntax is crucial in proof systems. Consider Boolean functions on n variables. We say that two Boolean functions f, g imply a third one h, denoted f, g ` h if every x satisfying both f, g also satisfies h, namely f(x) = 1 and g(x) = 1 implies h(x) = 1. Now let F be any family of Boolean functions on n variables, which contains the constant 0 function. (F roughly corresponds to the proof system at hand). A subset A ⊆ F is a contradiction if there is no input x satisfying all functions in A. A tree-like refutation for A is a binary tree whose nodes are labeled by functions from F satisfying the following conditions. • Every leaf is labeled by a function from A. • The root is labeled by the constant function 0. • If h labels a node, and f, g are the labels of its children, then f, g ` h. Note that any such refutation is indeed a logical proof that A is a contradiction. We seek natural contradictions A (typically, having poly(n) “simple” functions) for which the size (e.g. number of leaves) of every tree-like refutation is large (hopefully, superpolynomial or exponential in n). Let’s describe a general way to prove depth lower bounds on refutations which was proposed by Buss and Pudlak [PB94]. Its value is that for some families F , as the one we will focus on soon, a lower bound of d on the depth will imply a lower bound of exp(d) on the size—i.e. the result we were seeking. An F -query is simply an evaluation of any function f ∈ F on any input. Consider a player who is given an input x, and wishes to find a function a ∈ A such that a(x) = 0 (there must be one if A is a contradiction). Let QF (A) be the smallest number of queries needed to solve this search problem on the worst case input x. It is obvious that a lower bound on QF (A) gives a lower bound on the depth of any tree-like refutation of A220. We are now ready to explain the connection to communication complexity. The above “solitary game” describes what is commonly called a decision tree, albeit that here the set of allowed queries is non-standard221, and that here it computes a relation and not a function. Now assume that the bits of input x are actually divided between two players, Alice and Bob, e.g. x = y, z, with Alice receiving y and Bob z. Further assume that under this input partition, all functions f ∈ F have low communication complexity, e.g. D(f) ≤ c or R(f) ≤ c. Then a depth d refutation of A now translates to a 2dc (deterministic or probabilistic, resp.) communication protocol for the original search problem. In other words, communication complexity lower bounds imply proof complexity lower bounds, which will be especially useful if the upper bound c is small. This idea was used by Impagliazzo, Pitassi and Urquhart [IPU94] to prove a lower bound on tree-like cutting-planes refutations as follows. First, in the language above, the cutting-planes

220Simply, if we had a refutation of depth d, our player could start at the root (where the 0 function falsiﬁes its input x), and proceed down to a leaf, each time querying the functions labeling the children of the current node, and proceeding to any which falsiﬁes x. This will require 2d queries. 221The most well-studied case, called a Boolean decision tree, is when queries are simply the coordinate functions xi.

194 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

proof is captured by setting the family F to be all linear inequalities with integer coeﬃcients on the P variables xi of the input x. More formally, for every linear inequality of the form i sixi ≤ t (with 222 t, si integers ) f ∈ F assigns 1 to every x satisfying this inequality and 0 otherwise. It should be clear223 that the communication complexity of any such f ∈ F reduces to that of the function GE, namely testing which of two n log n-bit integers is larger. We have seen in the 2nd item of Theorem 15.2 that R(GE) = O(log n). Next, [IPU94] prove that for this cutting plane F , any tree-like proof can be balanced, thus depth lower bounds imply size lower bounds. Finally, they need a contradiction which requires high communication complexity. Luckily, the proof of Theorem 15.12 already implicitly contains such a contradiction. The monotone KW-game above for the perfect matching problem immediately suggests such a “perfect matching” contradiction, which is easily expressed by linear inequalities. We will not write this contradiction down explicitly here. Together with the Ω(n) lower bound on the probabilistic communication complexity in Theorem 15.12 (which was derived from Theorem 15.3), they conclude the required exponential lower bound. Theorem 15.13 [IPU94] The “Perfect Matching” contradiction on n-vertex graphs requires cutting- planes tree-like contradictions of size exp(n/ log n).

15.2.5 Extension complexity One of the most ingenious and unexpected applications of communication complexity comes from the paper of Yannakakis [Yan91]. In this paper, Yannakakis connects it with convex geometry, and shows how extension complexity of every high-dimensional polytope (which we will deﬁne soon) is captured exactly by the non-deterministic communication complexity of a related communication problem. This understanding has since played an important role in polyhedral combinatorics and optimization. But before I tell you that story, I have to tell you this story. Every year the ToC community is exposed to many new papers claiming to solve the P vs. NP problem (in much the same way the Math community is exposed to claimed solutions of the Riemann Hypothesis). Luckily, almost all such papers display blatant errors or misunderstandings and so can be ignored without much time investment. Occasionally however, such papers are not easy to dismiss: they seem to contain real ideas, are rigorously presented and who knows, may contain a proof. Dealing with these presents a nontrivial challenge to the community, as the claims are of the utmost interest. This is the story of one such attempt to prove P = NP, by Swart [Swa86]. The idea was simple and powerful. The Traveling Salesman Problem (TSP) is NP-complete. It can be written as a linear program, a problem which a few years earlier was found to be in P (as discussed at the end of Section 3.2). The main issue is that when written as a linear program in the original variables, the edges of a given graph, it has exponentially many linear constraints. What Swart suggested is adding auxiliary variables, and presented a new linear program, with only polynomially many constraints, with these variables added. He claimed that the new linear program also captures TSP, and hence P = NP. It was not easy, but some dedicated researchers found some errors in Swart’s program. Swart suggested a ﬁxed program, then more bugs were found in this one as well, etc. When should a community stop, when the solution to its most fundamental problem is possibly within reach?

222Which without loss of generality are no more than n log n bits in length; verify this fact! 223Alice and Bob can each separately compute the partial sum on their input bits.

195 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Yannakakis’s paper [Yan91] set out to prove that Swart’s approach above has to fail in principle! First, we must formulate this approach mathematically. We need a few preliminaries. A polytope P ⊆ Rn is the convex hull of a finite set of points V ⊆ Rn. Another convenient description of a polytope P is as the intersection of a finite number of halfspaces F , called facets. We assume that both V and F are minimal — removing an element of either yields a smaller polytope than P . Let |F | = f and |V | = v. The description of P via its facets gives f inequalities, concisely described by the linear program, P = {x : Ax ≤ b}, where x ∈ Rn, b ∈ Rf and A is an f × n real matrix. The basic decision problem, testing if P is empty (as well as optimizing over P , which we will not discuss) can be solved in polynomial time in the dimensions of A. The following example helps illustrate the complexity issues. Consider the problem of finding a 224 perfect matching in a graph G(U, E). The associated polytope PG is simply the convex hull of all perfect matchings, or more precisely, of all 0 − 1 vectors in RE that are characteristic vectors of perfect matchings. The facets of this polytope were determined by Edmonds [Edm65b], who proved that the following linear program defines PG. The variables are xe for every edge e ∈ E, and the inequalities are P • e3u xe ≤ 1 for every vertex u ∈ U. P • e∈S xe ≤ (|S| − 1)/2 for every odd cycle S ⊆ E in G. Note that if G is a bipartite graph, it has no odd cycles, f is the number of vertices, and thus the polynomial time linear programming algorithms can solve perfect matching in polynomial time for any bipartite graph! However, some other graphs G have exponentially many odd cycles, and this method cannot be used. For the perfect matching problem, Edmonds bypassed this issue, and discovered a very different polynomial-time algorithm [Edm65a]. However, when formulating standard NP-complete problems (e.g. Clique, Hamilton Cycle, Traveling Salesman, etc.) in the same way as linear programs they all have exponentially many facets, and of course a polynomial- time algorithm for any will imply P = NP. Extension of polytopes suggests a general method for reducing the number of facets, by adding 0 some auxiliary variables. A polytope Q ⊆ n+n is called an extension of P ⊆ n simply if P is a R 0 R projection of Q, namely P = {x : ∃y, (x, y) ∈ Q}, where y ∈ Rn . Here x are the original variables of P , and y are the new auxiliary variables. Clearly P is empty if and only if Q is. Let m be the number of facets of Q. So if we can make n0 + m much smaller than the original number of facets f, we win. This possibility is not a pipe dream; n0 + m can sometimes be exponentially smaller than f 225. Can something like this be done for the TSP polytope as Swart attempted? Define the extension complexity of P , e(P ), to be the smallest number of facets m in any polytope Q that extends P (it will automatically turn out that n0 = O(m) for this polytope Q, so we need not worry about it). Yannakakis’ first brilliant idea was a simple, complete characterization of e(P ), and his second was showing how nondeterministic communication complexity implies (nearly tight) lower bounds on e(P ). A critical definition is that of a slack matrix of a polytope P which we now give. Let F and V respectively be the facets and vertices of P = {x : Ax ≤ b}. Then the slack matrix SP of P is an F × V matrix whose (i, j) entry is simply bi − hai, vji, namely the distance from the jth vertex to the ith facet. It is crucial to observe that all entries of SP are non-negative! The next

224Recall that a perfect matching is a subset of the edges which cover every vertex exactly once. 225As an exercise, prove that the convex hull of all odd weight n-bit vectors requires exp(n) facets, and that adding O(n2) new variables reduces the number of facets to O(n2).

196 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

definition is of the non-negative rank of a non-negative matrix. It is defined like the usual rank of a matrix, insisting throughout on non-negativity. Namely, for an f × v non-negative matrix S let rk+(S) be the smallest m, such that S = RT for non-negative matrices R,T of dimensions f × m and m × v respectively. With these definitions, we can now state the characterization, sometimes called Yannakakis’ factorization theorem. + Theorem 15.14 [Yan91] For every polytope P , e(P ) = rk (SP ). The proof of this theorem follows directly from the definitions, linear algebra and the single “convex” fact (called Farkas’ lemma) that if a linear inequality is logically implied by a set of other linear inequalities, then in fact it must be a non-negative linear combination of these inequalities. In light of the discussion above, we would like to prove (hopefully exponential) lower bounds on e(P ) for some of the polytopes mentioned above. What can be said about the function rk+? First, unlike the usual rank, non-negative rank is a nasty function, and is NP-hard to compute even on Boolean matrices [Vav09]. Clearly, the usual rank (over the Reals) provides a lower bound, namely rk+(S) ≥ rk(S) for every S. But this bound can be extremely weak, e.g. there are matrices S with rk(S) = 3 and unbounded rk+(S)[Hru12]. Here comes the helpful connection to communication complexity, and for it, making our matrices Boolean will help. For a non-negative matrix S, let Sˆ be the Boolean matrix where we replace every positive entry with 1 (and leave the 0s alone). Note that if rk+(S) = m then the 1’s in Sˆ can be covered by m i monochromatic 1-rectangles. Specifically if S = RT then the m rectangles Rî ⊗ Tˆ cover the 1’s in i Sˆ, where Ri and T are respectively the ith row and ith column of R and T . In short, all we need is a polytope P such that SˆP has no small monochromatic cover. Yannakakis [Yan91] set all this up, but actually could not fully deliver the goods. He was able to show that Swart’s attempts were doomed using an extra property of Swart’s construction— symmetry—which when taken into account in this framework enabled him to obtain exponential lower bounds on the relevant “symmetric” extension complexity of the TSP polytope. But he left open the question of proving exponential lower bounds on the general extension complexity, and completely rule out this “linear programming approach” to proving P = NP. + This was finally achieved 25 years later, in the paper of Fiorini et al. [FMP 15]. Let Kn denote the complete graph on n vertices. + Theorem 15.15 [FMP 15] The extension complexity of the TSP polytope of Kn is exp(n). We only sketch the high level ideas of the proof. Rather than studying the slack matrix of the TSP polytope, the proof proceeds indirectly. Given the fact that TSP is an NP-complete problem, they reason that finding any explicit polytope which slack matrix is hard to cover in the sense above would do. Once this is achieved standard NP-completeness reductions would do the job. The difficulty remains to find an appropriate polytope. Their ingenious idea is using the so-called cross polytope. We will not describe it here, but rather describe the properties of its slack matrix S. Both the faces and the vertices of the cross polytope, namely the rows and columns of S, can be put in 1 − 1 correspondence with subsets of [n]. If two sets are disjoint, then the respective entry of S is 1. If the two sets intersect in a single element, the respective entry of S is 0. What about other pairs? We don’t care! Recall again the strong lower bound of Theorem 15.3. It is not hard to see that it implies (and some proofs actually prove it this way) that any cover of the 1’s in S requires exp(n) many rectangles. This provides the required lower bound on rk+(S) and hence the theorem. One can use the same idea to prove exponential lower bounds on the extension complexity of polytopes associated with many other NP-complete problems, via reductions. What could not be

197 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

done this way, and remained intriguing, was to determine the extension complexity of the perfect matching polytope for general graphs discussed in the beginning (a problem in P, albeit not via linear programming). This was resolved by Rothvoss [Rot14]. Interestingly, this lower bound bears some similarity to the one in Theorem 15.12, and indeed this connection was formalized in [Hru12] to show how extension complexity lower bounds can yield formula size lower bounds.

Theorem 15.16 [Rot14] The extension complexity of the Perfect Matching polytope of Kn is exp(n).

15.2.6 Pseudo-randomness The application here may look different from all others. So far we have seen computational lower bounds derived from communication complexity lower bounds. Here we sketch how a construction of a pseudo-random generator can be based on communication complexity intuition. However, it is quite similar in spirit, and we leave it to the reader to articulate the similarity (one hint is recalling that pseudo-randomness implies hardness). Nisan’s celebrated space-bounded pseudo-random generator [Nis92] was already mentioned twice in this book, in 8.5 and then in 14.1 as Theorem 14.4. This generator was motivated by a space lower bound mentioned at the end of Section 14.2 and both generator construction and proof of pseudo- randomness use it implicitly. A couple of years later Impagliazzo, Nisan and Wigderson [INW94] described a different pseudo-random generator, for which the proof of pseudo-randomness follows explicitly by a direct reduction to a statement about communication complexity226. To describe it, we’ll need to recall the notion of expander graph (see Section 8.7). To suit the communication complexity framework we define here a bipartite expander, for which the expansion property stated here is analogous (and more precise) to the property S1 in the expanders section (namely, that between any two subsets of vertices we find about the same number of edges as in a random graph with the same degree). The explicit constructions defined and described in this section yield the bipartite expanders we need here. A bipartite expander is a D = 2d-regular bipartite graph H(A, B; E) on two sets of vertices A, B of size N = 2n, such that for every two subsets A0 ⊆ A, B0 ⊆ B we have ||E(A0,B0)|/dN − |A0||B0|/N 2| ≤ = 2−d/3 (where E(A0,B0) is the set of edges between the two subsets). H is explicit if there is a poly(n, d) time algorithm that for every vertex v and an index i ∈ [D] outputs the ith neighbor of v in H. Note that the expansion condition is essentially one about the density of 1’s rectangles in the adjacency matrix of H relative to their size. Not surprisingly, as communication protocols are essentially partitions of a matrix to rectangles, this property translates immediately to the following communication complexity statement. We use the following notation. For a communication protocol P on n-bit inputs to Alice and Bob, and a distribution µ on the inputs, let’s denote by P (µ) the probability that P outputs 1 when the inputs to the players are chosen at random according to µ.

Lemma 15.17. Let P be any c-bit communication protocol, and H any bipartite expander as above with d = 4c. Then |P (U)−P (H)| ≤ 2, where U is the uniform distribution, and (abusing notation) H is the distribution picking a random edge from H and giving each player one endpoint of this edge.

226Due to this property, [INW94] can generalize the construction and give pseudo-random generators for more general computations.

198 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

We will not describe here the construction of the generator, only note that the expanders are used in [INW94] in a similar way to how hash functions are used in the original [Nis92]. The key property for the ﬁnal generator is the saving in randomness entailed in using the distribution H as opposed to U. Sampling from U requires 2n bits, whereas sampling from H requires only n + d bits. This saving is compounded via recursion in the same way as in [Nis92].

15.3 Interactive information theory and coding theory The field of communication complexity, besides creating a deep and broad theory with lots of applications as we have seen, has also branched naturally into studying basic issues that were classically in the realm of information and coding theory. These large fields are focused mainly on information transmission, namely 1-way communication of a messages held by one party227. In contrast, communication complexity studies information exchange, namely 2-way communication of adaptive conversations, e.g. some arbitrary function or relation of both parties’ inputs. Asking the classical questions of these fields, like the possibility of compression and tolerance to channel noise, naturally becomes far more challenging in the general interactive set-up. This study which has already led to some beautiful results and more open questions, is becoming a field of its own, in the intersection of information theory and computational complexity. We review below some highlights, first regarding compression of communication protocols, and then error-correcting schemes for them. In both we explain the similarities and differences of the 1-way and 2-way settings. Before starting, let us recall the following standard information theoretic quantities, defined by Shannon in his seminal paper [Sha48] that created information theory. Let there be random variables A, B, Z on the same finite set. E will denote expectation. All logarithms are base 2. We will develop further intuition about these quantities as we discuss them below. The entropy of A, intuitively the uncertainty in A measured in bits, is denoted H(A) and defined by X H(A) = − Pr[A = a] log Pr[A = a] a The conditional entropy of A given B, intuitively how much uncertainty is left in A after B is revealed, is denoted H(A|B) and defined by

H(A|B) = Eb[H(A|B = b)] The mutual information of A and B, intuitively how much knowing B reveals about A (and vice versa), is denoted I(A; B) and is deﬁned by

I(A; B) = H(A) − H(A|B) = H(B) − H(B|A) = H(A) + H(B) − H(A, B)

All these notions make sense when conditioning on a third variable Z. In particular, the conditional mutual information will be of particular relevance to us, and is deﬁned by

I(A; B|Z) = H(A|Z) − H(A|B,Z)

227Needless to say, this focus is plenty broad as is. The number of theoretical models and practical settings under which such a basic question is studied is vast, and occupied thousands of researchers for decades and many more in industry; the results are present in technology we all regularly use.

199 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

15.3.1 Information complexity, protocol compression and direct-sum A central complexity measure for communication tasks, besides communication complexity itself, is information complexity, introduced by Chakrabarti et al. in the paper [CSWY01], and evolved in [BYJKS02] and then [BBCR13], whose definition we shall use here. There are several (related) ways to motivate information complexity. One is as a generalization of Shannon’s source coding theorem for 1-way communication to the 2-way setting of communication complexity. Another is by trying to find a more “continuous parameter” than communication complexity, which is always an integer. A third is from the point of view of amortized complexity, when one attempts to solve the problem for many instances at once. We will see all these, but let us motivate the definition from trying to prove lower bounds on (distributional) communication complexity using information theoretic means. First, let us consider an arbitrary communication protocol π, when applied on a pair of inputs distributed according to a distribution µ. We abuse notation and let (X,Y ) denote the input random variables (jointly distributed according to µ). When executed on such random input, π defines another random variable Π = π(X,Y ), the transcript or conversation between Alice and Bob. Following the intuitive meaning of mutual information above, it is clear that Alice, holding X, learns at least I(Y ;Π|X) bits on average about Bob’s input Y from their conversation Π. Similarly, Bob learns I(X;Π|Y ) on average about X. Thus, the players must exchange at least as many bits, on average, as the sum of these two quantities. Let us formalize this. 228 For any protocol π and distribution µ define the information complexity Iµ(π) = I(Y ;Π|X)+ I(X;Π|Y ). Also, let Cµ(π) = Eµ|π(X,Y )| be the expected length of the communication. Then the argument above can be simply formulated to prove the basic lower bound

Theorem 15.18 [CSWY01, BBCR13] For every π, µ, Cµ(π) ≥ Iµ(π). Clearly, this lower bound extends to collections of protocols. For example, let Π(f, µ, ) be the set of all deterministic protocols computing f with probability at least 1 − on input distribution µ. Then the distributional communication complexity Cµ,(f) of this task was already defined as the minimum of Cµ(π) when π ranges over this set Π(f, µ, ). We similarly define Iµ,(f), the 229 information complexity of this task, as the infimum Iµ(π) over all π in that set. We have

Theorem 15.19 [CSWY01, BBCR13] For every f, µ, , Cµ,(f) ≥ Iµ,(f). From now on we will think of > 0 as tiny (indeed, negligible in other parameters) and will ignore it in notation. Further, we will fix a distribution µ, and so will remove it as well. Finally, it will be useful to think of f as a more general task than just computing a function, but any requirement on the outputs of a protocol (e.g. a relation, or different functions for each player, or even distributions). Everything we said so far, and will say later, holds in this generality. We will aim to understand the basic question: how good (or tight) this lower bound C(f) ≥ I(f) is. We will also ask the same questions for the amortized versions of these quantities, which we now define. Since Shannon’s paper [Sha48], a major focus of information theory was the cost, per input in the limit, of performing the same task many times on independent inputs. In the CS literature, this is known as the direct sum problem, which arises naturally for any computational model and resource. k Denote by f the task in which Alice gets (X1,X2,...,Xk), and Bob gets (Y1,Y2,...,Yk), with the (Xi,Yi) independent, each distributed according to µ, and the parties must succeed performing

228This is often called internal information complexity, to distinguish it from a related measure, external information complexity, capturing the amount of information a protocol reveals to an external observer about the players’ inputs. 229Being a continuous measure, there are tasks (even simple ones, like taking the AND of two bits) which have an inﬁnite sequence of protocols with better and better information complexity.

200 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

each of f(Xi,Yi) with probability at least 1 − (we stress that their messages may use their entire ¯ 1 k ¯ 1 k inputs!). Let us denote by C(f) = limk→∞ k C(f ), and similarly I(f) = limk→∞ k I(f ). The paper [CSWY01] was interested in the basic direct-sum problem, how tight is the obvious lower bound C ≥ C¯, and introduced information complexity mainly because, for this measure, the two are the same230! Theorem 15.20 [CSWY01, BBCR13, BR14] For every f, µ, , I = I¯. To study the two basic questions, namely how close are the lower bounds C ≥ I and C ≥ C¯, we seek intuition from early examples of communication tasks that were studied in classical information theory. Note that all may be viewed as compression results; in all I naturally captures the information contents of the problem, and we are trying to get the communication C to be as close to it as possible. Naturally some of the original results were not stated in this language. We also add or simplify using hindsight. First consider the case where Bob has no input (so y can be thought of as empty, or constant). The function to compute is the identity function on Alice’s input: idA(x) = x. Thus Alice simply wants to send her input (sampled from some distribution X) to Bob, as Bob learns x (and Alice can learn nothing new), every protocol π must satisfy I(idA) = I(X; Π) = H(X). Shannon [Sha48] proved the following lower bound, and the elegant Huﬀman coding [Huf52] gives the very nearly matching upper bound231. The amortized bound is Shannon’s famous source coding theorem. Theorem 15.21 [Sha48, Huf52]

• H(X) = I(idA)

• I(idA) ≤ C(idA) ≤ I(idA) + 1.

• I(idA) = C¯(idA). Now consider the same problem: Alice must transmit her input x to Bob, but now in the general situation that Bob does have an input y, and the pair is distributed as (X,Y ). In short, they are computing idA(x, y) = x. Using the same reasoning as before, any protocol must give Bob full knowledge of Alice’s input, thus every protocol π satisﬁes H(X|Y, Π) = 0, and so I(X;Π|Y ) = H(X|Y ). Of course, some protocols may give Alice information about Bob’s input. At any rate we have I(idA) ≥ H(X|Y ). The amortized case was studied by the well-known paper of Slepian and Wolf [SW73], and the one-shot case by Orlitzky [Orl92]. We note that, unlike Slepian-Wolf, who considered only 1-way communication, Orlitzky already considered 2-way communication, but showed that it doesn’t help for this problem (and so Alice learns nothing)232. Theorem 15.22 [SW73, Orl92]

• H(X|Y ) = I(idA).

• I(idA) ≤ C(idA) ≤ (1 + o(1))I(idA).

• I(idA) = C¯(idA).

230Proving this to within a factor of 2 is easy and sufficed for the motivation; the exact result follows from [BR14] which we shall soon discuss. 231We are cheating a bit here as for Huffman coding C really denotes “average-case” as opposed to “worst-case” communication complexity we are using throughout. 232 A good example to consider is when Bob’s y is a pair of n-bit files, (z0, z1) and Alice has one of them. If Bob talks first, it is easy to solve the problem with log n + 1 communication. Can you do the same when only Alice talks? Hint: hashing!

201 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

One final example is the problem id(x, y) = (x, y), namely the two players must exchange their inputs. This was studied by El Gamal and Orlitzky [EGO84]. They have several results, which we slightly overstate and summarize informally about the one-shot task233. The amortized case of course follows from the Slepian-Wolf theorem above, applied to idA and idB separately. Note that arguing as above, H(X|Y, Π) = H(Y |X, Π = 0) must hold for any id protocol, and so I(id) ≥ H(X|Y ) + H(Y |X). Theorem 15.23 [SW73, Orl92] • H(X|Y ) + H(Y |X) = I(id). • I(id) ≤ C(id) ≤ (1 + o(1))I(id) for “almost” all distributions µ. • I(id) = C¯(id). Let us try to generalize from these examples. First, we consider the amortized case, which seems to be cleaner. In all examples we have I(f) = C¯(f)! Indeed, these exact equations are often viewed as operational definitions of entropy and conditional entropy, giving practical motivation to their abstract mathematical definitions above. What about other tasks f? The important theorem of Braverman and Rao [BR14] shows that we always have equality, thus giving a precise characterization of amortized communication complexity! Theorem 15.24 [BR14] For every task f, I(f) = C¯(f). Let us say a few words about the proof. As we have seen in other chapters, picking the right “universal” or “complete” task f would do the job via reduction, which is precisely what they do. This task is abstracted as a joint sampling problem on a pair of distributions which are close in the KL-divergence metric. Their communication efficient protocol for this problem (which does require 2-way communication), may be viewed as a generalization and strengthening234 of the Slepian-Wolf theorem (which does not). We now return to the “one-shot” compression problem, namely how tight is C ≥ I in general. The first paper to directly address this general question, develop general techniques for protocol compression, and in particular prove the best general compression result known so far was by Barak et al. [BBCR13]. They focus on compressing a given protocol, which of course implies compression results for general tasks. This can be informally defined as follows. Fix an arbitrary input distri- bution235 and a protocol π. One is looking for another protocol π0, which (with probability 1 − as usual) will compute the transcript π(X,Y ). Hopefully, π0 will be compressed, namely will use less communication than π, perhaps as little or close to its information complexity (which is the minimum possible). Another desired property is that the computations of Alice and Bob in π0 are essentially as efficient as those in π. This efficiency requirement holds for all known simulations! Theorem 15.25 [BBCR13] For every protocol π there exists another protocol π0 such that C(π0) ≤ pC(π) · I(π)(log C(π))O(1). This result shows that one can always compress communication of any protocol roughly to the geometric mean of its original C and I. How good is this result? One can construct artificial protocols, (and there even exist natural ones), where C is far greater than I, unboundedly so.

233A good example to consider here is that x is a random n-bit file, and y is another random file differing from it in some random set of coordinates of size at most s. 234Especially with respect to the convergence rate to the limit. 235We survey here only results regarding general input distributions µ. Much more is known for restricted families of distributions, in particular when X and Y are independent.

202 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

In such cases, communication reduces by a square root, but does not approach the information complexity. Thus, it would be nice to obtain a compression result that depends only on I. Such a compression was discovered by Braverman [Bra15]. Theorem 15.26 [Bra15] For every protocol π there exists another protocol π0 such that C(π0) ≤ exp(I(π)). Are there much better compressions possible? Ganor, Kol and Raz [GKR14,GKR15] proved that Theorem 15.26 cannot be improved, not only for individual protocols, but for computing certain tasks as well. Theorem 15.27 [GKR14,GKR15] For every integer m there exists a Boolean function f such that I(f) = O(m) but C(f) ≥ 2m. We can now interpret these results in light of the characterization C¯ = I of the amortized communication complexity. These represent signiﬁcant progress on the very old direct-sum problem in communication complexity. When this problem was raised, in the 1980s, it was believed to be possible that solving any problem k times requires roughly a k-fold increase in the communication cost236: C¯(f) = Ω(C(f)). However, no nontrivial upper or lower bounds were found for decades. The information complexity approach implies the following. Combining the two theorems above we have one tight bound: Theorem 15.28 [Bra15, GKR15, BR14] • For every communication task, f, C¯(f) ≥ Ω(log C(f)). • For some Boolean functions f, C¯(f) ≤ O(log C(f)). Also, Theorem 15.25 implies that some multiplicative cost must be incurred in amortization, which is better stated when we explicitly take into account the number of instances solved (and suppress logarithmic factors). √ Theorem 15.29 [BBCR13, BR14] For every task f and integer k, C(f k) ≥ Ω( kC(f)).

15.3.2 Error-correction of interactive communication We now turn to dealing with noise on the communication channel, and how to make communication reliable despite it. We focus on the most typical noise model, namely bit-flips. The major idea of battling noise using error-correcting codes was introduced in two papers by Shannon [Sha48] and Hamming [Ham50]. Shannon studied random errors, and Hamming adversarial errors; we’ll discuss both, first in the 1-way communication and then in the interactive setting. An excellent detailed survey of the material summarized in this section here is [Gel15]. Assume that Alice wants to send Bob an n-bit message x. However assume that every bit sent across their communication channel may be flipped, independently of all others, with probability ≤ p. The parameter p is the maximum “noise rate” per bit. The idea of error-correcting codes is to send an encoding of x, which has some redundancy to counter the noise. Formally, an error- correcting code is a function C : {0, 1}n → {0, 1}m. The ratio n/m, capturing the redundancy of C, is called the rate of the code C, denoted R(C). The code C tolerates adversarial noise p if for every n-bit message x, and for m-bit sequence z which differs in at most pm coordinates from C(x), the original message x can be uniquely

236Indeed, the fact that this bound holds for the monotone KW-relations mentioned above was key for proving some superpolynomial lower bounds for monotone formulas in [KRW95].

203 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

decoded from z. As Hamming points out, this is possible if and only if the Hamming distance 0 0 dH (C(x),C(x )) > 2pm for every different message x 6= x . Note that this forces p < 1/4. The code C tolerates random noise p if for every n-bit message x, if we independently flip every bit of C(x) with probability ≤ p to obtain z, the message x is uniquely decoded from z almost surely237. Note that this forces p < 1/2. Shannon determined precisely the redundancy needed for every noise rate p. Indeed, he proved, in one of the earliest applications of the probabilistic method, that a random code of that rate will do so. Let H(p) denote the binary entropy function. Theorem 15.30 [Sha48] For every p < 1/2, and every R > 1 − H(p), there is a code C of rate R(C) = R which tolerates random noise p. Moreover, no code C of rate R(C) < 1 − H(p) tolerates random noise p. Following these papers Gilbert [Gil52] and Varshamov [Var57] proved that constant rate is achievable also for adversarial errors, although what is the exact rate needed is still an open question. Theorem 15.31 [Gil52, Var57] For every p < 1/4, there is a code C of rate R(C) > 1 − H(2p) which tolerates adversarial noise p. In particular, a constant size blow-up m = O(n) is sufficient redundancy to tolerate the maximum possible noise level in both models! Of course, this is hardly sufficient for practice, as the codes above are not given explicitly, and the encoding and decoding procedures they suggest are highly inefficient. A long sequence of works has finally led to explicit codes with extremely efficient encoding and decoding algorithms in both models. Major achievements were Spielman’s [Spi95] constant rate code with linear time encoding and decoding in the adversarial noise setting, and Arıkan’s [Arı09] Polar Codes which achieve Shannon’s bound with near-linear time encoding and decoding. In short, despite many fine questions regarding these and other parameters, this basic problem of protecting 1-way communication against errors is well understood. Now suppose that we change the problem from Alice sending an n-bit message to Bob across that noisy channel, to Alice and Bob having an n-bit conversation. The main difference to stress between these tasks is that a conversation is adaptive. Bob’s response to Alice’s first bit may depend on its value! And this dependence diverges exponentially as the conversation proceeds. There are many examples which illustrate the devastating effect of even a little noise on adaptive conversations. Imagine for example a game of “20 questions” (or more generally binary search), where the first answer is flipped; the search proceeds in the entirely wrong part of the space. Similarly, suppose the parties play a game of Chess, and Alice’s first move, say ‘e4’, is received on Bob’s side as ‘d4’. The rest of the game will be nonsensical. So, suppose we want to protect against noise via error-correcting codes, as in the 1-way case. The main difference to stress between these two settings is that in the 1-way case, the entire message is there, held by one party which can encode it at the start. Here neither Bob nor Alice know the conversation, as it is evolving. The best they can do is encode each new bit they send, possibly with the history of the conversation so far. But this looks like it might have little value, as one key element in all classical error-correcting codes is the dependence of each output bit in C(x) on a large number of bits from x (indeed, a constant fraction). The analog of Shannon’s work for error correction in this interactive setting was the sequence of seminal papers by Schulman [Sch92, Sch93, Sch96] in the early 1990s. In these works he both formulated the problem and proposed the first solution, remarkably showing that in the interactive setting almost nothing is lost: one can protect against constant error rate p, even adversarial, paying only a constant factor overhead in the length of the communication! Schulman defined

237For Shannon that meant with probability 1 − exp(−n).

204 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

error-correcting protocols, and what it means for such protocols to tolerate both adversarial and random errors at bit rate p. The rate of such a protocol is, as in the classical case, the ratio of the number of bits communicated in the original (noiseless) protocol and the number of communicated bits in the error-tolerant one. Error-correcting protocols can have complex structure; here we only explain one elegant notion from Schulman’s work that many error-correcting protocols are based on. A central notion Schulman introduced was an interactive analog to classical error-correcting codes, which he called tree code. As is forced by the players’ limited knowledge, define C : {0, 1}n → n Σ to be a tree code if for every x and index i ∈ [n], C(x)i depends only on the first i bits of x. Here Σ is a finite alphabet (e.g. if Σ = {0, 1}c then the output length of C is m = cn). The rate of a tree-code C is, as before, the ratio of input to output length, so R(C) = 1/|Σ|. A central measure of quality of tree codes, generalizing the (normalized) Hamming distance for classical code, captures how much encodings differ after they first diverge. More precisely, a tree code C has relative distance δ = δ(C) if for every two inputs x 6= x0, if C(x) = uw and C(x0) = uw0 0 0 then dH (w, w ) ≥ δ|w|, where u is their longest common prefix, namely the first bits of w and w differ. Schulman’s main results were the existence of tree-codes with constant rate and distance, and a protocol allowing the parties to use such codes in interactive error correction, even for adversarial errors. We note that unlike for 1-way communication, utilizing a tree code for decoding is highly nontrivial, as the players have to catch errors and correct them during the protocol (rather than only at the end), sometimes re-encoding parts where too many errors occurred (and thus unlike the 1-way case, the input x to the tree-code C is far from being the original, non-noisy conversation!). Theorem 15.32 [Sch96] There exist tree codes C with R(C) = O(1), δ(C) = Ω(1). Consequently, there are error correcting protocols which tolerate adversarial (and hence also random) error rate p < 1/240. As in classical error correction, the proof is via the probabilistic method, and so the code is not explicit, and the encoding and decoding are inefficient. This was remedied, and a sequence of works led to highly efficient, probabilistic error-correction protocols that can tolerate constant adversarial error rate. The best known such protocols are in [BKN14, GH14] (with the last one achieving the best possible error rate, p < 1/4). No analogous deterministic protocols are known! Finally, let us address the random noise model, in which the classical 1-way case achieved a particularly satisfying complete understanding of the tradeoff between noise rate and the rate of the error-correcting protocol in Theorem 15.30. Recall that for noise rate p, the optimal code rate is 1 − H(p). In the interactive case what we know is far less precise. However, it is known that such a rate cannot be achieved, at least for very small values of p. The results are somewhat sensitive to the exact communication model. One weak analog of Shannon’s theorem was given by Kol and Raz [KR13] and another by Haeupler [Hae14]. Ignoring logarithmic factors, and the model details, they can be summarized informally as follows. Theorem 15.33 [KR13, Hae14] The best possible rate of an error-correcting protocol tolerating random noise rate p is 1 − Θ(pH(p)). Note that for small p, H(p) ≈ p log 1/p, which demonstrates that interactive error correction is more costly than non-interactive one. In this regime (and ignoring logarithmic factors), 1-way communication needs to add to an n-bit message about pn extra bits of redundancy, whereas √ interactive communication needs to add to an n-bit communication about pn bits of redundancy. Determining the interactive trade-off more precisely is a very interesting open problem, es-

205 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

pecially for ﬁxed p (where the above theorem says little). Also, in these results too the protocols are probabilistic. Obtaining deterministic protocols that are as eﬃcient as probabilistic ones, for both adversarial and random noise is another important question (see the current state-of-art in [GHK+16]). The best approach to the last question, and perhaps the most elegant open problem of this theory, is the construction of explicit tree codes with constant rate and distance.

Open Problem 15.34. Construct explicit, eﬃciently encodable and decodable tree codes of constant rate and constant relative distance. A beautiful construction, whose correctness rests on an unproven conjecture regarding exponential sums is given in [MS14b].

206 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

16 On-line algorithms: coping with an unknown future

Is hindsight really 20/20, as the saying goes? What exactly is the power of clairvoyance? Here are a few concrete examples from people’s lives, encompassing the need to make periodical decisions without knowing the future. They illustrate the need for the models, algorithms and analysis we discuss in this chapter.

• Investment: You have some portfolio of stocks you own. Every day (or month, or year), given the prices of the stocks, you take a decision to buy and sell some. How should you choose?

• Gym: You go on a whim every so often to the gym (or the theatre). When you go tomorrow, should you buy a yearly subscription for $500, or pay only $50 for a single ticket? • Dating: You seek a lifetime mate, and are in a relationship. Should you continue dating that person, or terminate it in the hope of ﬁnding a more suitable one? • Memory: Some psychologists and neurologists believe that our “working memory” can hold at any one time only 7 (well, some say 4 or 5) diﬀerent “things” (concepts, ideas, facts). As your environment changes (you start driving, or meet intellectuals, or sit down for dinner) you subconsciously replace some of them with others—how does your brain decide what to discard and what to upload? • Taxi: You are the taxi dispatcher, and a new request arrives to take someone from A to B. Which of the available taxis should you send?

In all of these examples, a sequence of “events” (requests, facts, etc.) is arriving one at a time, and each requires making a decision. Each decision has a cost/benefit associated with it (which depends on your current state), and it also changes the state you are in. Algorithms facing such situations are called on-line algorithms. While the input arrival structure is similar in spirit to the streaming algorithms we saw in Chapter 14, here the task at hand is far more general than saving memory. Indeed, no limit is put on the computational resources required by the decision maker, and the model is a purely information theoretic one. It isolates only the central aspect: what is the best course of action, as each signal arrives, when future signals are unknown. As can be seen (and imagined) from the variety of the examples, this is an extremely general and important problem, and we will only touch on some basic aspects and examples. A comprehensive book on the subject is [BEY05], and a more recent book is [Haz16]. These books, and other sources we’ll reference explain connections of this important area to game theory (and strategies for playing well), convex optimization, learning theory, inductive inference, and more. The most basic question is what is a good way to model the quality of an on-line algorithm? A bold answer called competitive analysis was proposed by Sleator and Tarjan [ST85]. In contrast to many previous studies, they advocate completely ignoring any knowledge of a potential “prior distribution” about future events. Rather, they suggest comparing the performance of the on-line algorithm on each and every input sequence to that of the best algorithm with hindsight; an optimal “off-line” (clairvoyant) algorithm which knows the full input sequence before making any decision! Roughly speaking, an on-line algorithm is called c-competitive if for every possible input sequence, the cost of the on-line algorithm is within a factor c of the cost of the optimal off-line algorithm. An algorithm is competitive if it is c-competitive for some finite c. The boldness in this definition

207 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

is manifest in the suggestion that a finite c may be achieved, which does not depend of the input, in particular on the input length. Intuition, and perhaps life experience, suggest that knowing the future should give enormous hindsight power in situations like the examples above. As it happens, this intuition is often wrong! Starting with this seminal paper which powerfully demonstrated this possibility, numerous examples of scenarios of competitive on-line algorithms were found. We will give a couple of examples (and one non-example) of this surprising phenomenon, but we will first define everything more precisely. We give one very general definition (introduced and named request-answer games in [BDBK+94]), of which most specific scenarios and models of the field are special cases. It will be convenient to denote, for any sequence z = z1, z2,... and any integer t smaller than its length, zt to be the tth t element of the sequence, and z to be the tth prefix of z, namely z1, z2, . . . zt. An on-line problem is specified by a set E of events, a set D of decisions, and a family of cost t t functions C = {Ct : E ×D → R} for every integer t. The input to an on-line problem is a sequence T e = e1, e2, . . . , eT ∈ E . So, each et ∈ E is the “event at time” t. The total time (= number of events) T is arbitrary and unknown to the algorithm (and as we shall see, may be thought of as infinite if desired). t An on-line algorithm A is a sequence of functions At : E → D, specifying the next decision given t 1 2 t the input so far. Thus it is unambiguous to denote for every t by A(e ) = A1(e ),A2(e ),...At(e ) ∈ Dt the sequence of t decisions made in the first t time steps by A. The cost A incurs in step t t t is Ct(e ,A(e )), and we denote by CA(e) the total cost incurred by A over all decisions, namely PT t t CA(e) = t=1 Ct(e ,A(e )). The off-line (or optimal) cost of a sequence e is easy to describe—it is simply the minimum PT t t cost incurred by the best sequence of decisions. Namely, OPT (e) = mind t=1 Ct(e , d ), where the minimum is taken over all possible d ∈ DT (d may be viewed as the actions of a hypothetical off-line algorithm which sees the entire input e in advance). An on-line algorithm is said to be c-competitive (for a given on-line problem defined by (E,D,C)) if there is a universal constant238 M such that for every sequence e (of every finite length) we have

CA(e) ≤ c · OPT (e) + M. Sometimes we say that A has competitive ratio c. Two simple observations follow. First if A is c- competitive, no other algorithm does better by a factor of more than c. Furthermore, this statement holds not only for the final input sequence, but also for every prefix of it. Let us start with a simple example of an on-line problem for which there is no competitive algorithm. Assume E = D = {0, 1}. The problem is guessing the next bit in the sequence. Thus, regardless of the past, you pay (say) $1 if it is guessed incorrectly and pay nothing otherwise. In symbols, Ct(e, d) = et ⊕ dt−1 for any t > 1 and any two sequences d, e of length t. It is obvious that OPT (e) = 0 for every e (simply by choosing d = e). On the other hand, it is clear that for every (deterministic) algorithm A, and for every length T , there is a sequence e of length T for which CA(e) = T − 1. Simply, pick e1 arbitrarily, and subsequent et as the complement of what the t−1 239 algorithm predicts, namely et = 1 − A(e ). Thus A does not have a finite competitive ratio! . This example suggests a very useful view of the competitive analysis definition: the sequence e may be viewed as generated by an adversary, one symbol at a time, having full information about the algorithm A.

238In some contexts M is allowed to grow, but should be kept asymptotically smaller than OPT . 239With the natural extension of on-line problems and competitive analysis to allow randomness, a similar argument can show that even a probabilistic algorithm A cannot achieve a competitive ratio better than T/2.

208 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

We now turn to two very general examples where nontrivial competitive on-line algorithms do exist! These will formalize some of the informal examples above. We note that some of them are quite simple, and it would be nice for you to try them. For instance, ﬁnd a 2-competitive algorithm for the Gym problem (a special case of the all too familiar “buy or rent” problem).

16.1 Paging, Caching and the k-server problem Consider the following formalization of the “working memory” example above, which actually is quite practical in computer memory systems which are organized hierarchically (as our brain may be organized as well). There is fast memory, or cache, which can hold k data items, and a much larger, slow memory. The event set E is simply all data items, an arbitrary k of which are initially in the cache and the rest in slow memory. Requests of the system to access data items arrive (this is the input sequence e). If the requested item et is in cache, no decision need be made, and no cost is incurred (due to the fast retrieval from cache). However if the requested item et is not in the cache, it must be moved there, and to make room for it, a decision must be made as to which item from the cache is to be moved to slow memory. Regardless of which item is removed, the cost is $1 (i.e. paying for the time to access slow memory). This problem is called the k-paging problem. It is clear that an adversary can create a request sequence that will make any on-line algorithm pay $1 at every step, simply by requesting items outside the cache. But note that in such a case even an off-line algorithm will have to access slow memory every so often. The question is, does this problem have a competitive algorithm? The competitive ratio can depend on k, but not on the length of the sequence. Think about it before reading on! A natural heuristic (which our brain may be using too) is what is known as the “Least Recently Used” (or LRU for short) algorithm. This algorithm simply always discards the item in the cache that has been last requested the earliest (practically, one can e.g. keep the items in the cache in an ordered list, placing each newly requested item at the start of the list, and always discarding the last one when needed. This fits our general model above, as it has access to all history). The analysis of this algorithm is one of the initial examples in the Sleator-Tarjan paper [ST85], where they determine precisely the quality of this algorithm (in much more generality than we state). Theorem 16.1 [ST85] The algorithm LRU is k-competitive for the paging problem. Moreover, no on-line algorithm for this problem has a competitive ratio smaller than k. Let us now generalize the setting above quite a bit, to the famous k-server problem, introduced in [MMS90]. It may be viewed as a concrete model for the Taxi problem above, and many others with the following structure. The requests are points in some metric space, there is a limited number (k) of resources to handle requests, and service cost is derived from the distance traveled to service. Formally, fix a metric space M = (E, dist); so the requests set E is simply points in the metric space, and dist is a distance function between pairs of points (satisfying the triangle inequality). The k “servers” initially reside on some points of M. Now a sequence of requests, namely points of M, arrive one at a time, and your job is to decide which of the k servers to send there. The cost is the distance traveled by that server from its current location to the new request point. It should be clear that the paging/caching problem above is the very special case in which the metric space is uniform, namely the distance between every pair of points is the same, say 1. Can we have a competitive algorithm in this general setting? A positive answer was conjectured in [MMS90]; indeed they conjectured a competitive ratio of k is possible, as in the uniform case. A major result in the field, by Koutsoupias and Papadimitriou [KP95], comes very close to confirming this conjecture with their ingenious analysis of the so-called Work Function algorithm.

209 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Theorem 16.2 [KP95] The Work Function algorithm is (2k − 1)-competitive for the k-server problem. It will not surprise the reader that also in the on-line setting, randomness can play a crucial role, and that the model extends to allow probabilistic algorithms which outperform deterministic ones. For example, there is a probabilistic algorithm (that as usual is correct for every input, with high probability over its random coin tosses) for the k-paging problem which is O(log k)-competitive240. As we know that k is the best possible competitive ratio even for the paging problem, we see that randomness can be provably exponentially more powerful in this parameter. An important source of this power comes from the fact that now the adversary generating the input sequence, while knowing the algorithm, does not know the random coin tosses in advance. Subtle issues regarding the interaction of the adversary and probabilistic on-line algorithms, and models capturing them, are studied in [BDBK+94] and exhibit natural situations in which randomness can enhance on-line algorithms by at most a polynomial factor.

16.2 Expert advice, portfolio management, repeated games and the multiplicative weights algorithm Finally we get to questions about predicting the future that almost everyone is concerned with on a daily basis, like which weather channel to trust and which financial expert to listen to. Amazingly enough, in very general situations, you can do practically as well as the best expert in hindsight with only the knowledge of past performance! If you are wondering why such an astounding possibility is not used by everyone to do as well on the stock market as legendary investors like Warren Buffet, well, it is a good question and there are many answers. But, read the theoretical results below, and you can decide for yourself whether to try them at home. They are certainly in extensive use in numerous applications, including financial investments! We should note outright that we are changing the model! We will now be comparing an on-line algorithm to the best one from a restricted family of off-line algorithms (the experts), as opposed to the best off-line algorithm. The reason is simple—in these settings typically there can be no competitive algorithm in the sense of the previous section, and this new, more limited setting of comparing to the best expert in hindsight is still very general. The key to many of these surprising results is a single, extremely important “meta-algorithm” called the multiplicative weights update algorithm which may be viewed as a “smooth” way of taking past information into account when making future decisions. Thus it may be viewed as a “learning” algorithm, and certainly arises in machine learning (that we will discuss shortly). But again, in the spirit of this chapter, no assumptions are made about future events, and they can be determined by an adversary who knows the algorithm. Variants of this algorithm were discovered in many diverse application areas by many people. It was even suggested that this algorithm was independently “discovered” by nature, and that it naturally occurs in evolution [CLPV13, MP15]! It is certainly simple enough to be implemented in a distributed fashion, by simple organisms and possibly even by genes. This algorithm made an appearance already in Chapter 8.8 of this book, in the completely different context of pseudo-randomness; it would be good for you to compare it with what we’ll show here. An excellent survey of the many incarnations and uses of this algorithm is [AHK12]. We describe a simple variant of this algorithm, called the Weighted Majority algorithm of Little- stone and Warmuth [LW94], which is designed to handle binary predictions241. For example, will it

240A possible poly log k-competitive probabilistic algorithm for the general k-server problem remains open. 241This algorithm follows similar ones originally developed for boosting in computational learning theory, which we

210 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

rain or not tomorrow? Or, will the price of a given stock go up or down tomorrow? This algorithm will suggest a method to aggregate the “advice” of k different “experts” about such events into a decision, which over time, on every sequence will perform nearly as well as the predictions of the best expert on that sequence. Let us formalize the on-line problem at hand, and then explain the algorithm and its performance analysis. The events E are pairs (b, v) where b ∈ {−1, 1} and v ∈ {−1, 1}k which should be understood as follows. The bit b is a fact, about the reality at this time step (e.g. did a particular stock price go up or down today). The vector v is the opinions of k different experts about reality in the next time step (e.g. whether that stock price will increase or decrease tomorrow). At this point the algorithm makes its decision, namely a 1-bit prediction about tomorrow. On the next step, reality is revealed and the algorithm learns which predictions (its own and the experts’) were correct, and which were not. The cost of a wrong decision, to the algorithm and to an expert, is (say) $1. Thus, we will be counting mistakes (or wrong predictions), and the goal of the algorithm is to minimize these in comparison with mistakes of the best (in hindsight) expert among the given k. Note that the expert who made the fewest mistakes can change over time! Now let us describe the Weighted Majority algorithm, which as mentioned can be viewed as a simple version of Multiplicative Weight Updates. The updates will be to an evolving “estimate” of our trust in the different experts. Initially, we trust them all equally, and so assign to each a weight 1. As we observe some experts making mistakes, our trust in them will decrease, multiplicatively, by a constant factor. Our decision how to aggregate their predictions will be simply by a weighted majority according to their current weights. Let us be a bit more specific. Let wt(i) denote the weight of the ith expert at time t (so for t = 0 we have w0(i) = 1 for P al i ∈ [k]). Denote by Wt the total weight at time t, namely Wt = i wt(i). Thus W0 = k. At each step, as the current value of b is revealed, we can tell which of the experts was right and which were wrong in predicting it in the previous step. We decrease our trust in each particular expert who makes a mistake as follows: if expert i was wrong in predicting in step t, then we set wt(i) = wt−1(i)(1 − ). Note that the update is multiplicative, and the parameter often has to be chosen carefully to trade-off the “speed of learning” and the “volatility of the predictions”. It is good to think of as a small constant, like .01. Finally, the algorithm predicts the weighted majority to the predictions vt(i) of the experts with the current weights wt(i). More precisely, the P algorithm predicts the sign of i wt(i)vt(i). This algorithm is nearly 2-competitive (with respect to the best expert).

Theorem 16.3 [LW94] For any t, let Mt be the number of mistakes made so far by the Weighted Majority algorithm, and let mt(i) be the number of mistakes made so far by the i’th expert. Then for every i Mt ≤ 2(1 + )mt(i) + O((log k)/) The analysis is quite simple, and follows the intuition of the algorithm. The following two claims relate the weights and mistakes of both the experts and the algorithm, and follow by induction on t. For any expert i, its weight decreases by (1 − ) with every mistake, and so at time t it is exactly −mt(i) wt(i) = (1 − ) . On the other hand, whenever the algorithm makes a mistake, experts of total weight Wt/2 must have made a mistake by the weighted majority rule, and (as W0 = k) we have Mt P −mt(i) that Wt ≤ k(1 − /2) . As Wt = i wt(i) we have that for every i Wt ≥ wt(i) = (1 − ) . Combining the two bounds and taking logarithms proves the theorem. discuss in Chapter 17.

211 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

A natural question is whether the competitive ratio of 2 (as surprising and good as it may be) is the best possible. Perhaps even more surprisingly, with the help of randomization, we can approach a competitive ratio of 1, namely make almost as few mistakes as the best expert in hindsight. This is shown in the same paper of Littlestone and Warmuth which also suggests the Randomized Weighted Majority algorithm; it updates trust in experts exactly as the deterministic version, and makes only the decision probabilistic. Instead of a weighted majority, the algorithm simply follows the prediction of the ith expert with probability wt(i)/Wt. This happens to “smooth out the worst case” in the above analysis, and yields a nearly 1-competitive algorithm, in expectation.

Theorem 16.4 [LW94] For any t, let Mt (which is now a random variable) be the number of mistakes made so far by the Randomized Weighted Majority algorithm, and let mt(i) be as before the number of mistakes made so far by the ith expert. Then for every i, the expected number of mistakes of the algorithm is bounded by

E[Mt] ≤ (1 + )mt(i) + O((log k)/) The performance of on-line algorithms is often expressed in terms of regret, namely the largest gap between the performance of the on-line algorithm and the best performance in hindsight. Let us present the last result in this language. Let i∗ be the expert with the minimum number of mistakes in some number T of rounds. Thus the (expected) regret E[MT ] − mT (i∗) is bounded by mT (i∗) + O((log k)/). Using the trivial bound mT (i∗) ≤ T , and choosing (which can be set at will) to balance the two terms in the bound, one sees that after any number T of steps the regret is bounded by p E[MT ] − mT (i∗) ≤ O( T log k). √ Thus, for very large T , the average regret per step is only O(1/ T ) (even though it could be 1). This dependence on T is best possible. It is not hard to imagine how to generalize the algorithm from this binary decision setting to one in which decisions and costs are continuous, say in the bounded interval [0, 1] instead of the binary {−1, 1}. The updates then depend on the magnitude of the “error” made by an expert, and if that loss is g ∈ [0, 1] the algorithm will reduce its weight by a factor (1 − )g. The probabilistic algorithm will choose as before to follow an expert picked at random with probability proportional to its weight. The same analysis shows that the cost to the probabilistic algorithm will be as close as we want to the cost to the best expert in hindsight. One beautiful application of this continuous generalization above is to playing repeated games, which was discovered by Freund and Schapire [FS99], and we brieﬂy describe next. A natural setting in which we are attempting to do well against a sequence of adversarial moves is of course a game. Consider the familiar zero-sum game setting from game theory (think e.g. of Rock-Paper-Scissors). A real matrix M describes a 2-player (full information) zero-sum game as follows. The Row player picks a row i of M, the Column player simultaneously picks a column j of M. The gain of the Row player, which is equal to the loss of the Column player, is M(i, j). Playing such games well has been understood for nearly a century, with von Neumann’s discovery of the minimax theorem which determines the value of the game (the best possible outcome for both players), and linear programming provides a polynomial-time algorithm computing the optimal mixed strategies for both players which achieve the game value. Does this understanding kill the subject? Far from it, and the following questions were considered in game theory already in the 1950s. Suppose the players don’t know M, and are only told their loss/gain after playing? Suppose M is too large for linear programming to be eﬃcient

212 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

enough? Suppose your opponent plays sub-optimally—can you gain more than the value of the game? If the game is played once, there is nothing much one can do with these questions, but if the players play the same game repeatedly (e.g. two competitors repeatedly setting the prices of their products), the on-line setting gives this problem a new life! Can you see how to use the algorithm above to play asymptotically in the best possible way against any opponent? Let’s assume for now that M is known. The idea is to use the weighted majority algorithm above. Consider your pure actions (e.g. the different rows if you are the Row player) as your experts. Each round, as you learn your opponent’s move, reveals the gain/loss of each of your own choices/experts. This allows updating the weights, which serve as your mixed distribution for the next action. This play achieves essentially what can be achieved by the best pure strategy against the adversary, and so does at least as well as the value of the game. Moreover, as explained in [FS99], this algorithm also leads to a simple new proof of von Neumann’s minimax theorem! How about playing when M is not known, and only the payoffs are revealed at every step? As it happens, there is a variant of this algorithm which works (with somewhat worse performance) also in this case. Let us conclude with money, which is probably why you have stuck with this chapter till the end. We now describe the Portfolio Management problem. There are k stocks in which you have initially invested some amount (say $1000), distributed according to a vector p = (p1, p2, . . . , pk) where a fraction pi is invested in the ith stock. This vector p describes your portfolio. The values of these stocks vary daily, and the question is how to reinvest their total value. One commonly used approach (good especially to the lazy investor) is simple rebalancing—distribute the new value again according to p. Of course, the question is which p would yield the best performance over time. Just to show how this simple strategy can yield exponential earnings in a volatile market, say you invest in Apple and Microsoft. Further assume that over time the Apple stock remains flat at $1, 1 while the Microsoft stock alternates between $ 2 on odd days and $2 on even days. If your portfolio 1 1 was p = ( 2 , 2 ), a simple calculation will show that rebalancing will grow your wealth exponentially, by a factor (9/8)t after any even number t of days. Of course, if your portfolio picked only one stock of the two (either p = (1, 0) or p = (0, 1)) your wealth will remain essentially the same over time242. It is the best of all these choices (with hindsight) that we will compare ourselves to! We wish to design an on-line algorithm, which can select a different portfolio every day after seeing the stock values, which can be competitive243 against the best fixed portfolio rebalancing. The seminal paper of Cover [Cov91] suggested this problem, and defined an on-line algorithm as universal if, roughly speaking, for every t and > 0, if the best portfolio achieves growth ct in t days, then the online algorithm achieves growth (c − )t. Amazingly enough, this can be done, and Cover describes and analyzes one such universal algorithm. His algorithm and subsequent ones were exponential in the number of stocks k, until Kalai and Vempala [KV03] found a polynomial-time algorithm with the same performance as Cover’s (an even more efficient algorithm was later given by [HAK07]). These algorithms are not obviously of a multiplicative weight update form; however [HSSW98] show that this problem fits the general framework and give such an algorithm for it.

242Try finding an example where balancing a fixed portfolio will shrink your assets exponentially fast. 243In a somewhat weaker sense than defined above, which is suitable for situations where exponential growth can be expected.

213 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

17 Computational learning theory, AI and beyond

In this chapter we face an extremely general modeling problem: how to define, and then design, algorithms which learn from experience and use it to cope with new, different situations that may arise. In this generality, such algorithms must be able to learn to walk and talk like a child, to fly or swim, find food and shelter like a young animal, make up theories from data like a scientist, prove theorems like a mathematician, play musical instruments and compose, lead an army and start-up a company, discuss philosophy and emotions, laugh at jokes, have offspring, etc. All life forms around us, and especially humans, seem to be born with some basic capacity and drive to learn, and then go through life acquiring experience and using it (in various degrees of success) to survive, thrive and reproduce. Even when ignoring the huge scientific question of how algorithms performing these tasks evolved in living beings (a question which computer science should play a major part in answering), we can ask the more concrete question of how to design computer systems with some of these capabilities. As you know, some aspects of this project are already a reality. We live in the era with great advances in “machine learning”. Many computer systems have actually learned, rather than been directly programmed, to do some amazing feats, many of which we use already or will soon use. Such systems provide individual recommendations (e.g. of books, movies and more), feature and content recognition in images, language translation, medical diagnostics and treatment, weather and stock market prediction and more. Learning programs are now beating humans at Chess and Go, and may well replace “data scientists” completely, rather than only assisting them in doing “data science” and “knowledge discovery”. Self-driving cars are practically around the corner, promising multiple changes in our daily routine. And there are numerous more examples. Indeed, in this (possibly the 3rd) revival of the AI dream (or nightmare), some predict that within this century most aspects of human intelligence and cognition will be paralleled or surpassed by machines. We will not discuss most of these issues or speculations here. Much of the current rapid progress is based on heuristics which use the amazing computing capabilities and huge amounts of data available today. Clearly far more theoretical understanding is needed and hopefully(!) expected. In this chapter we will only discuss some initial, concrete models, algorithms and mathematical results of computational learning, that address some aspects of this extremely complex subject. We will specifically discuss what is known about the power and limits of learning in these models. While they are still evolving, and new ones are being introduced, some of the principles and models suggested in these initial works are naturally used in the current work in machine learning, and may also serve to model natural phenomena from evolution to cognition. Learning is a big word, loaded with multiple meanings, about which generations of scholars have debated and written voluminously. An often quoted (operational, as opposed to cognitive) definition of learning algorithms was given by Tom Mitchell [Mit97]: “A computer program is said to learn from experience E with respect to some class of tasks T and performance measure P, if its performance at tasks in T, as measured by P, improves with experience E.” In this chapter we will discuss some concrete meanings which can be given to the unspecified notions in this definition. Let us start with the “Experience”, the interaction of the learner with the environment. One can divide the models broadly into two classes244 with respect to that interaction. The first, supervised learning, implicitly assumes the existence of a “teacher” who provides side information about raw data. The “teacher” can vary from a devoted parent or actual classroom teacher, to any knowledgable entity (like Internet users labeling their pictures), to an

244And many intermediate ones.

214 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

environment, which rewards/punishes living organisms on their behavior, be it foraging for food or investing in the stock market. The second, unsupervised learning, does not assume such a teacher nor any side information, and the learner must “make sense” of the data without such help. Naturally, these situations are much harder to learn from, and we refer the reader to the extensive textbook [Mur12] which exposits a large variety of models and techniques. The textbook [BGC15] focuses on the recently favored meta-model of deep learning (which is used in both the supervised and unsupervised settings). Here we only discuss supervised learning. The main (general) task we discuss in the category of supervised learning is classification, which in various texts is referred to also as identification, concept learning, and other terms aimed to capture natural ability to generalize and extract a rule (or function, or pattern, etc.) from examples. We will completely ignore the numerous philosophical debates, starting in antiquity, about the possibility of learning from examples, about justification for doing so, and everything else which comes under the heading the problem of induction in philosophy245.

17.1 Classifying hyperplanes—a motivating example In thinking about the stylized identification problem below and the following discussion, it may be useful to think of some familiar problems from real life. For example, a small child learning to identify a particular animal (e.g. cat) from a sequence of images labeled by “this is a cat” or “this is not a cat” (possibly provided by a parent). Or alternatively, think of a computer program (like the one used by Amazon and other companies) that is trying to identify a particular reader’s taste in books, from a sequence of book descriptions (e.g. title, author and synopsis) with the bit “I liked this book” or “I did not like this book” (provided by the reader). Or a scientist, who is trying to identify (the relevant signs of) a disease from a sequence of people (represented by a list of physical characteristics) and for each the bit of whether a certain genetic marker is present or absent. Here we replace animals, readers and diseases from the real-life examples above with hyperplanes in high dimensional Euclidean space, and the task with identifying a particular hyperplane from labeled points in space (this problem is often referred to as linear classification). Hyperplanes may seem like an extremely synthetic, simplistic choice of concept to learn, which no one really cares about. As it happens, identifying hyperplanes is extremely important, and is much more relevant than you might imagine to identifying animals, literary tastes, diseases, and many other concepts. Indeed, let us see that the concept of spam e-mail can naturally be viewed as a hyperplane (which is how many spam filters represent them). Say that the typical e-mail vocabulary is from a specific vocabulary of 1000 words. Represent that e-mail as a vector x ∈ Rn for n = 1000, where the j’th entry x(j) represents the number of occurrences of the j’th word from the vocabulary246. Now each of us may have their personal signs of spam. For example, if you see “Viagra” once that’s clearly spam. But possibly you can tolerate 4 occurrences of “Pharmaceutical”, two of “click here”, as well as the combination of 2 “Pharmaceutical” and one “click here”. It makes sense to assign P weights h(j) to each word, and if the total weight hh, xi = j h(j)x(j) exceeds a certain threshold value v. Then, the hyperplane in question is represented by the linear equation247 hh, xi = v, such that e-mail x is deemed spam if hh, xi > v and not spam if hh, xi < v. Of course, this hyperplane

245We note that it is sometimes amusing to read how people, who as babies could neither speak nor reason at all, argue in sophisticated language the impossibility of learning or gaining knowledge from examples. 246Note that this representation, which again is very common way to treat text, ignores the order of words and keep track only of their frequency. 247With h being the normal vector to the actual hyperplane in space and v its distance from the origin in direction h.

215 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

representation of spam is just a (very simple) model, but lets assume it is an accurate model. Now consider how a spam filter will identify your “individual” hyperplane (which depends on your personal taste and tolerance, which perhaps are subconscious even you cannot specify) simply from your marking of different e-mails as “this is spam” and “this is not spam”. Let us first formalize the problem, and then discuss algorithms for it. We make two assumptions without loss of generality. We assume that any vector h is a unit vector (namely has Euclidean norm 1),a and the v = 0 (namely the hyperplane goes through the origin)248. Now, consider the task of identifying an unknown vector h∗ in Rn representing such a hyperplane in space through the origin. The information given is a (possibly infinite) sequence n of pairs (often called labeled examples)(x1, b1), (x2, b2), (x3, b3),... , where xi ∈ R are points and ∗ ∗ bi = sign(hh , xii) is the “side” (or halfspace) of h that the point xi resides in, namely −1 if the ∗ inner product is negative, and +1 if positive (and 0 if xi is on h , although we can assume this lucky case never happens). We will view this (and classification problems in general) as an on-line problem, similar to the ones studied in the previous Chapter 16, namely one in which the algorithm observing the sequence should propose a hypothesis after seeing every new example249. Equivalently, we seek an algorithm that for every finite sample produces a hypothesis. Here are two natural (efficient!) algorithms for this classification task.

Perceptron algorithm This algorithm will produce, on every input pair, a new hypothesis for the value of h∗, and will continue doing so indeﬁnitely, judiciously modifying its last hypothesis if it is inconsistent with the next labeled example. We start by setting h0 = 0, and after the ﬁrst t − 1 ≥ 0 input pairs have been processed already, with ht−1 being the last hypothesis, proceed as follows on the next input pair (xt, bt): do nothing if consistent, and tilt it “towards” xt if not. More precisely, we set ht as follows:

t−1 t t−1 • Correct classiﬁcation: If bt = sign(hh , xti, set h = h .

t−1 t t−1 • Incorrect classification: If bt 6= sign(hh , xti, set h = h + btxt/kxtk. The perceptron algorithm was invented by Rosenblatt [Ros58] and analyzed soon afterwards by Novikoff [Nov62] (numerous subsequent improvements and generalizations of this analysis followed, see the survey [MR13]). We will describe the analysis later on, in Theorem 17.1 (the interested reader may jump ahead and then return here). We now turn to a possibly simpler and more natural, albeit somewhat less efficient algorithm which uses linear programming.

Linear Programming Every finite number of labeled examples naturally defines a system of linear inequalities satisfied by h∗. More precisely, assume that we have (a parameter) s labeled examples. For each such input pair (xi, bi) with i ∈ [s], write a linear inequality bihh, xii ≥ 0, whose variables are the coordinates of h. The algorithm solves the resulting system of inequalities ˆ using an efficient linear programming algorithm (recall that this problem is in P). Its output hs is the hypothesis for the hidden hyperplane h∗.

248It loses no generality by adding one more dimension. 249While similar, the focus is diﬀerent. In On-line algorithms, the task is usually known in advance, and an algorithm designer can use arbitrarily sophisticated methods and analysis in solving it. In machine learning, usually there is far more limited information about what is to be achieved, and the eventual (prediction) algorithms extracted form the data are typically simple, coming from a small arsenal of methods.

216 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Note that this algorithm can be adapted to behave as an on-line algorithm, like the previous 0 t one. Namely, starting with h = 0, on every subsequent input pair xt, bt output a hypothesis h , as follows:

t−1 t t−1 • Correct classiﬁcation: If bt = sign(hh , xti), set h = h .

t−1 t • Incorrect classification: If bt 6= sign(hh , xti), let h be the output of the linear program for the system of inequalities derived from the first t examples. It is worth noting at least one obvious extension of the problem of learning hyperplanes, which is handled by both algorithms easily. This extension turns out to be extremely useful and demonstrates the power of this problem under via simple reductions. Hyperplanes partition Rn by a linear equation. Instead, we can consider partitions of Rn defined by polynomial equations of higher degree, which gives a much richer class of identification problems. Observe however that there is a simple reduction from the later to the former. Specifically, consider polynomials p : Rn → R of degree d. Let m ≤ nO(d) denote the number of monomials in a polynomial of degree at most d. Given a point x ∈ Rn, it can be mapped to a point x0 ∈ Rm which evaluates x in every such monomial250. Then, if p0 ∈ Rm is the list of coefficients of p, the value p(x) is clearly given by the linear form hp0, x0i. Thus labeled examples for linear inequalities (x, sign p(x)) can be converted to labeled examples for linear inequalities (x0, sign(hp0, x0i)), and this data can be used by the algorithms above to identify p0 and hence p. The cost of this reduction naturally increases with d. Various methods for achieving further efficiency and generalization come under “support vector machines” and “kernel methods”, which we will not elaborate on here.

17.2 Classification/Identification—some choices and modeling issues We will be using Classification and Identification interchangeably, as different sets of literature use them. The task at hand is to identify one, from a given collection of functions (sometimes called concepts, or predicates, or rules), using data which arrives in a stream of labeled examples. This task seems pretty concrete and focused. However, there are still important choices to make, and we list some of them. We will not discuss the awareness of the identification algorithm of these issues and the modeling decisions regarding them. This is a highly non-trivial component when discussing e.g. child (or animal) learning algorithms, and how they evolved. But (as in previous chapters) it is completely reasonable to assume this awareness for algorithms that humans design, given such a specific classification task.

Target class of functions This family of functions (often called concept class), is the scope from which we are trying to identify a single function (or concept). Typically it is a collection F = {f : X → Y } of functions from a fixed domain X to some fixed range Y , and the task is to identify one of them. The domain X and range Y can each be finite or infinite, even continuous (although for actual algorithms continuous objects are typically represented by discrete approximations). Here are some examples. We will discuss some of these later.

1. All linear equations over a given ﬁeld. 2. All polynomials over a given ﬁeld.

250This is called the Veronese map (or embedding) in algebraic geometry.

217 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

3. All axis-parallel rectangles in the plane (e.g. representing all people in a certain age interval, and certain income interval). More generally, one can consider parallelepipeds in Rn (for properties with n attributes)251. 4. All circles in the plane (e.g. representing all residences within a certain distance from some ﬁre station or hospital). More generally, one can consider balls in Rn.

5. All conjunctions of literals (variables or their negations), e.g. x7 ∧ ¬x2 ∧ x4 over a set of Boolean variables (e.g representing the joint presence or absence of certain features like GPS, FWD, ABS, Cruise Control, etc. in the car you want to buy). 6. All DNF formulas (disjunction of conjunctions) over a given set of Boolean variables (e.g. representing your willingness to purchase a car with any one of a given set of features). 7. All functions computable by a ﬁnite automaton. 8. All functions in P (representing property you can actually verify eﬃciently).

Hypothesis class The identifying algorithm must respond to the given data with hypotheses. These come from a collection of functions H = {h : X → Y } which typically (but not always) contains F . As elements of H are the outputs of the learning algorithm, they are often speciﬁed by the class of algorithms (or machines) computing these hypotheses. For example, H may consist of small formulas, low degree polynomials, ﬁnite automata, decision trees, Turing machines with resource limitations, etc.

Admissible presentation of Data In the way we have set things up, data arrives in a sequence of labeled examples (xi, f(xi)) for a sequence of points xi ∈ X. A central issue is deciding how that sequence of points {xi} is chosen. Of course, to make learning models most general, one tries to assume the least about the way nature provides such examples in “natural” situations. This suggests letting an adversary generate the sequences252. Very broadly speaking, these adversaries can be limited in one of two possible ways (related to the two main evaluation criteria in the next bullet on quality measures): 1. The adversary can choose an arbitrary sequence, which eventually includes every point in X. 2. The adversary can pick a completely arbitrary probability distribution on X, after which the elements of the sequence are drawn independently from this distribution.

A crucial assumption we made above is that the labels of the data points are always correct. This of course in general is unrealistic, and a variety of relaxations have been studied, allowing both some fraction of noisy labels (random or adversarial) and perturbed labels (which are “small” in some metric over the range Y ). We will not discuss these important generalizations here, although some of the positive results we mention extend to accommodate such errors, and many algorithms and heuristics are especially designed to tolerate them.

251 Here and in the next item X is not discrete. However we can replace the Reals R with the Rationals Q without any consequence to the issues at hand. 252As we will see at the very end, adversaries considered in this chapter are too strong, in that very few concepts can be learned if they are unrestricted. And naturally, variants restricting them, as well as other relaxations were studied as well.

218 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

In an orthogonal direction, another natural form of data acquisition by learning algorithms allows them to ask queries. Numerous types of queries have been considered, including letting the algorithm choose some of the points xi, requesting points xi which violate the current hypothesis, and others. Similarly, the number (or frequency) of such queries is another important parameter when they are allowed. Queries can add signiﬁcant power to learning algorithms. We will not consider such models here either.

Quality measures for identification algorithms What is a good identification algorithm? Ideally, one would want the algorithm to quickly learn the target concept (or function) so as to make little or no future mistakes in its hypotheses. Corresponding to the two general types of adversaries above, two notions of mistake bounds were considered: 1. Completely stopping making errors after some finite number of samples. 2. Reducing the probability of errors as the number of samples grows.

The two represent very different philosophies with respect to learning in general—one which is more logically and linguistically oriented, and the other more statistically oriented. We will discuss each in the next two subsections. An important aspect for both approaches is the speed of learning. Two “input size” parameters are important to account for efficiency of identification algorithms. First is the length of a single labeled example in the sequence; this is usually fixed given the domain X and range Y (and often captures the dimensionality of the problem, e.g. the dimension n in identifying hyperplanes). The other is the number of examples (namely the sample size) needed to obtain high quality predictors of the target function. Ideally, the number of samples should be small, and the algorithm should be efficient in terms of both parameters. Perhaps surprisingly, there are important situations where there is a non-trivial trade-off between the number of samples and algorithm efficiency, which we will discuss later.

17.3 Identification in the limit—the linguistic/recursion theoretic approach In a nutshell, this direction generally assumes that data arrives adversarially, allows some unspecified but finite “teaching” period, after which the “learner” has to get it perfectly right. The notion of inductive inference is almost as old as the theory of computation. One of the main original fields of study to drive it forward was linguistics, borrowing both from the computational perspective of computability and recursion theory, and from the scientific perspective of trying to understand how natural languages evolve and are learned (by humans and animals). An excellent survey of this research direction of research is [AS83]. We only discuss some of its basic features and results. The seminal paper, which has shaped this approach, was written by Gold [Gol67]. In this paper he addresses the modeling issues considered above. In particular, he defines an important notion of success of an algorithm, namely identification in the limit. Gold also suggested a (simple) general technique which achieves such success called identification through enumeration, and studies its power. Let us explain and give examples of both. Fix a family of functions F = {f : X → Y }. The admissible input presentation Gold considers is the first one we described above—an adversary selects a function f ∈ F , and then selects the

219 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

order in which examples xt appear, as long as every element of X appears at least once (and if X is finite, each element appears infinitely many times). An algorithm observes the sequence (xt, bt) with bt = f(xt), and after every such example outputs an hypothesis ht : X → Y . The class F is identifiable in the limit if there is an algorithm which, for every such adversary, makes only a finite number of mistakes. More precisely, after some finite time T , for all t ≥ T all t t T T h are the same (namely h = h ) and are correct (namely h (xt) = f(xt)). We stress that the algorithm may not know what T is, namely there is no requirement that the algorithm “knows” when it stopped making mistakes. This is a clear (modeling) weakness of this learning model, which indeed makes it very strong and allows it to identify very complex function families. We will now give three examples of target classes which have identification in the limit algorithms, to get a sense of what is learnable (and at what cost), and what is not.

Example 1: The class P Let F = P, the class of Boolean functions on binary inputs computable by polynomial-time algorithms. A simple algorithm to identify this class in the limit applies the following simple idea, which Gold calls identification through enumeration. It uses a subroutine which enumerates all polynomial-time Turing machines (recall that each has a finite description, as does the integer exponent bounding the polynomial running time), namely prints a list M1,M2,... of them all (some possibly computing the same function). Now, for every t, the identification algorithm selects the smallest n for which Mn in the list above is consistent with all examples seen so far (namely for all s ≤ t, Mn(xs) = bs), and outputs that Mn as its hypothesis ht. To see that this algorithm identifies P in the limit, consider an arbitrary (hidden) f ∗ ∈ P used to label the ∗ data, and let k be the smallest integer for which Mk in the enumeration above computes f . It is clear that each of the Mn with n ≤ k, if chosen as hypothesis by the algorithm, will make a mistake after a finite number of examples. Furthermore, once Mk is chosen once, it will be chosen forever. It should be clear that this algorithmic technique is very general. All it requires is two properties from the function class F . First, that there is an algorithm to enumerate F . Second, that each function in F is computable (to check consistency with the data so far). Gold observes that these properties hold in particular for all language253 classes in Chomsky’s hierarchy (Finite, Regular, Context Free, Context Sensitive, Recursively Enumerable), and so all are identifiable in the limit. So, identification by enumeration is extremely powerful, but it should also be clear that the identification algorithm underlying it can be arbitrarily inefficient. Moreover, even though all functions in the class P are efficiently computable and so the second property is efficiently testable, one may have to enumerate at step t an exponential (in t) number of machines before finding a consistent one (it is left as an exercise for the reader to check that it is never worse than that—the algorithm above will never run in time worse than exponential in the length on the data available). Of course, the running time for other target classes may be much larger. Our next example shows that in some cases efficient learning in the limit can be achieved.

Example 2: Rational polynomials Let X = Q, the ﬁeld of rational numbers, and F = {p : Q → Q} be the set of all univariate polynomials. It is clear that the enumeration algorithm above applies as well to this target class, as it is enumerable and every function in it can be eﬃciently evaluated. Still, in an obvious implementation as above it will require exponential time, even for this simple subclass of P. However, due to interpolation one can do much better, as there is no

253As discussed much earlier in the book, a language associated to a function f :Σ∗ → {0, 1} is the set of sequences f maps to 1.

220 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

need to search for the minimal consistent hypothesis—a unique one is well-defined, and moreover one can find it efficiently. To be more precise, here is how the identification algorithm works: 0 Start with some null hypothesis, e.g. h = 0. On every subsequent input pair (xt, bt) output a hypothesis ht, as follows:

t−1 t t−1 • Correct classiﬁcation: If bt = h (xt), set h = h .

t−1 t • Incorrect classification: If bt 6= h (xt), let h be the unique degree t − 1 polynomial interpolating the first t examples. The reader is invited to verify that if the hidden polynomial p∗ used to generate the data has degree d, then by step T = d + 1 all hypotheses will be the same polynomial p∗, and that the algorithm will run in polynomial time in the data length. The same naturally holds for polynomials over finite fields254. Examples for which such an efficient identification in the limit is possible are rare. We will now see that it can be done as well for the first motivating target class we considered, namely hyperplanes.

Example 3: Real hyperplanes Recall from Section 17.1 above the problem of identifying a hyperplane h∗ from a sequence of examples. We gave two algorithms for the problem, Perceptron algorithm and Linear programming. As it turns out, both efficiently achieve identification in the limit, in a somewhat weaker sense than the example of polynomials above; they converge to the correct answer after a finite number of mistakes, but this finite number depends on a parameter called margin, common to many identification and more generally learning algorithms in continuous spaces. We will define it formally below, but intuitively, it captures the robustness of the data to small fluctuations. E.g. in the spam mail example we used to motivate hyperplane classification, one expects that for any pair of e-mails, one legitimate and one spam, there will be a significant, noticeable distance between them, and that the larger this margin is, the more efficient the classifier will be. We will now see this intuition in action. We will only analyze the perceptron algorithm for classifying hyperplanes. We recall the algorithm again for convenience. t Start by initializing h0 = 0. After the tth sample set h as follows:

t−1 t t−1 • Correct classiﬁcation: If bt = sign(hh , xti), set h = h .

t−1 t t−1 • Incorrect classification: If bt 6= sign(hh , xti), set h = h + btxt/kxtk. Let us analyze this algorithm. For the analysis, definex ˆ = x/kxk to be the scaling (to a unit length) of a vector x ∈ Rn. Also, let us introduce a parameter µ, called the margin, which is ∗ data dependent, and measures the minimum distance of the pointsx î to the hyperplane h . Thus, ∗ µ = infihh , xii. Note that the larger µ is, the better separation we have between the sets of points on the two sides of the hyperplane; indeed, they are not separated by h∗, but actually by a strip in the same direction whose width is 2µ. The margin determines a finite bound (which is independent of the dimension n!) on the total number of prediction mistakes made by the perceptron algorithm. Theorem 17.1 [Nov62] The total number of incorrect classifications of the perceptron algorithm on a data sequence of margin µ is at most 1/µ2.

254The reader is invited to contemplate multivariate polynomials over the Rationals or over ﬁnite ﬁelds.

221 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

An interesting observation to make at this point is that even if the number of samples is finite n (namely, the sequence {xt} contains only finitely many distinct points in R ), cycling through them sufficiently many times (depending on the margin) will lead the perceptron algorithm to find a hypothesis consistent with the data. Proof (sketch). The simple idea behind this proof of Novikoff has been used many times in analyzing other, more sophisticated algorithms, and rests on contrasting progress in the L1 and L2 norms. Intuitively, the correction made to the hypothesis ht−1 after every incorrect classification improves the correlation of ht and the true separating hyperplane h∗. On the other hand ht is not much t−1 t−1 longer than than h due to the fact that the angle between h and xt is obtuse, andx ˆt is a unit vector. Combining both facts will bound the number of mistakes. Let’s make it formal. t ∗ We will bound, from above and below, the inner product Ct = hh , h i, which is 0 at t = 0. t−1 Assume that the prediction of h on xt is mistaken. For the lower bound, note that

t ∗ t−1 ∗ t−1 ∗ hh , h i = h(h + btxˆt), h i ≥ hh , h i + µ and so after N classiﬁcation errors Ct ≥ µN. On the other hand

(hht, h∗i)2 ≤ khtk2 ≤ kht−1k2 + 1

∗ where we have used the Cauchy-Schwarz inequality and the unit lengths of h andx ˆt, along√ with t−1 the fact that there is an obtuse angle between h andx ˆt. Thus after N errors we have Ct ≤ N. Combining the bounds we conclude that N ≤ 1/µ2.

17.4 Probably, Approximately Correct (PAC) learning—the statistical approach In a nutshell, this direction assumes that data is generated randomly, insists on quantitative bounds on the number of labeled examples and on algorithmic efficiency, but allows unlimited prediction errors as long as they occur with low probability. The notion of distribution-free learning was born in the seminal works of Vapnik and Chervo- nenkis [VC15, VC74], arising from the fields of statistical learning theory and probability theory, with a strong focus on sample complexity. A comprehensive treatment of this work and its origins and applications appears in Vapnik’s books [Vap98, Vap13]. Independently but quite a bit later, Valiant [Val84b] came up with the same notion. However, motivated by understanding learning as a cognitive process, and the need to distinguish feasible and infeasible cognitive tasks in any theory of learning, Valiant made the computational efficiency aspect of learning algorithms central to his model. The term Probably, Approximately Correct (or PAC learning for short) for this model was coined in [AL88]. An excellent intuitive introduction to this viewpoint on learning is the book by Kearns and Vazirani [KV94b]255. There are many essential differences between the approach of inductive inference taken in the previous section and the statistical approach taken here. The main contrast is evident in the one- line italicized summaries above of each. The logical framework of inductive inference is unforgiving to prediction errors. To achieve such perfection eventually, it is literally willing to expend an

255We note that in the literature “PAC learning” is sometimes taken to mean the original distribution-free learning of Vapnik and Chervonenkis (which disregards computational complexity), and sometimes as its efficient version of Valiant. We will stress the efficiency aspect of learning algorithms in the definitions and results below, distinguishing “PAC learning” and “efficient PAC learning”.

222 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

arbitrarily long teaching phase. In contrast, the statistical framework forgives prediction errors if they are rare, and insists on a short teaching phase and efficient learning. While mathematically both are very interesting, considering theoretical and practical work on computational learning today, one can say with certainty that the statistical approach has won big time. This is true even for the original motivation of the logical approach, namely understanding the evolution and learning of languages, and translating and generating linguistic text. Perhaps the strongest reason for this advantage of the statistical approach is that in nature, inefficient learning can be far more damaging (for surviving and thriving) than imperfect learning. Moreover, essentially all practical products of machine learning are based on this view. Finally, the statistical, complexity theoretic view also seems to suggest better models explaining how natural mechanisms of learning may have evolved; this view is elaborated in Valiant’s book [Val13]. We return to the concrete task of classification in this framework.

17.4.1 Basics of the PAC framework For simplicity, we restrict ourselves from now on to identification of Boolean functions, namely the range Y = {0, 1}. This case is often called Pattern Matching in the statistical learning theory literature and binary classification in the machine learning community. Extensions of the theory were studied for larger ranges Y , which can be either discrete or continuous (e.g. see the books above). Unlike the Boolean domain, where for every data point in X a hypothesis is either correct or incorrect, the quality of a hypothesis on a point (namely how much it disagrees with the correct answer) has to be defined, often using some metric on Y , or more generally a loss function. The study of this general setting is often named empirical risk minimization, where the “risk” is taken with respect to the loss function. Back to Boolean ranges. Fix a target class of functions F = {f : X → {0, 1}}, and furthermore an arbitrary probability distribution256 D on X. In distribution-free PAC learning, admissible data to a classification algorithm (sometimes called classifier) is a sequence of labeled examples ∗ ∗ (xt, f (xt)), where the samples xt ∈ X are chosen independently according to D, and f is the hidden function we are trying to identify (or classify). Again, an algorithm produces a sequence of hypotheses ht after observing the first t examples. Let us first explain intuitively what a good algorithm in this setting is, and then define it more precisely. An algorithm is good if after some T steps, the hypothesis it outputs predicts the value of f ∗ on the next point with high probability. We stress that the number of necessary examples T does not depend on the underlying distribution D (this explains the term distribution-free!). This sample size T can and will of course depend on properties of the target concept class F , and the two error parameters (accuracy and confidence, defined below) that govern the quality of prediction after so many examples. There are two issues to discuss regarding the distribution D. First, it is stationary and does not change throughout the process; if this D is viewed as an environment generating experiences for the learner, then we can view stationarity as fairness: the learner is tested on experiences of the same type it has learned from257. This assumption is sometimes called invariance, and is certainly a strong one. Even stronger is the assumption of independence of the samples. Both

256Or measure, in continuous domains X; we will not be concerned here with measurability issues, which are not central to this topic. 257As in high school, when students demand that the test contains only questions previously discussed in class. Or, as in the wild, African lions test their hunting strategies near the same water supply antelopes come to drink at every evening.

223 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

assumptions ignore (or sweep under the rug) the fact that in nature and practice, the hypothesis of the learner often generates action/behavior that affects the environment and future examples it may generate258. Still, these assumptions are natural in an initial mathematical model, and moreover we will see that only a few general classes are learnable even with these assumptions. Once we accept them, every sample is as good as any other, and so from now on we’ll consider a training set (rather than a sequence) of T labeled examples, and a hypothesis h is tested on a single random sample from D. With this, we are ready for the formal definition of PAC learning259. Definition 17.2 [VC15,Val84b]. A concept class F = {f : X → {0, 1}} is PAC-learnable if there is a, possibly probabilistic, (learning) algorithm A and an integer valued function T = T (F, , δ) with the following property. For every probability distribution D on X, and for every function f ∗ ∈ F , on inputs , δ > 0 (respectively the accuracy and confidence parameters) and t ≥ T independent examples from D labeled by f ∗, the algorithm A returns an hypothesis h = ht that with probability at least 1 − δ satisfies D(h 4 f ∗) ≤ . Here h 4 f ∗ is the subset of X on which f ∗ and h disagree, and D(h 4 f ∗) denotes its mass under D. The success probability is computed over distribution D generating the examples, and any coin tosses of the algorithm A. The algorithm A is called efficient if it runs in time polynomial in the parameters 1/, 1/δ, and the total length of the T samples260. If the algorithm A is restricted to output hypotheses only from the target class F , then this class is called proper PAC-learnable. Let us relate the sources of the words “Probably” and “Approximately” in the PAC acronym to the two error parameters. Probably is associated with δ—the algorithm must produce a good hypothesis with high probability: at least 1 − δ. A good hypothesis is one which is approximately correct: the probability that h and f ∗ disagree on a random sample from D is at most . Which classes of functions are PAC-learnable? And if so, by which algorithms? These two general questions have very clean answers, that we shall motivate and explain below. Remarkably, a simple single combinatorial parameter of the target concept class F determines whether it is PAC-learnable or not. It is called the VC-dimension, after its inventors Vapnik and Chevonenkis [VC15]. Intuitively, it captures how “rich” the class of functions F is when restricted to any finite set of elements of the domain X. For a finite set S ⊂ X, we let FS denote the set of all restrictions of functions in F to S. That richness of F is the size |FS| as a function of |S| for the worst possible S. This richness happens to be determined by the largest S for which FS is |S| maximal, namely S is fully “shattered” by F . Formally, we call a set S ⊂ X shattered if |FS| = 2 , namely every possible Boolean function on S can be extended to a function in F . Definition 17.3. The VC dimension of F , denoted VC dim(F ) is the largest size of a shattered set in X. If no such largest set exists we define VC dim(F ) = ∞.

Try proving the following VC dimension bounds on some of the function classes we discussed. This will ensure the clarity of the definition, and demonstrate that even when F is large, infinite, or even uncountable, it can have small VC dimension. 1. The VC dimension of axis-parallel rectangles in the plane is 4. More generally, the VC dimension of all axis-parallel boxes in Rn is 2n. 258Note that this objection does not affect the previous learning notion of “identification in the limit”. 259We prefer identification to learning, but this notion is very common in the literature. 260It would stand to reason to also demand that T itself is small in terms of the error parameters, and properties of F . As we shall see this will be guaranteed automatically.

224 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

2. The VC dimension of hyperplanes in Rn is n+1. Moreover, the VC dimension of any collection of hyperplanes with margin (see example 17.3 above) at least µ (in any dimension!) is at most 1/µ2. 3. The VC dimension of conjunctions over n Boolean literals is n.

4. The VC dimension of any ﬁnite family F is at most log |F |. In particular, the VC dimension of the class of all Boolean functions having a size-s DNF formula, (or even having a size-s Boolean circuit) is at most s2. The punchline is that this simple combinatorial parameter, the VC dimension of function classes, determines PAC-learnability, and yields an optimal learning algorithm with optimal learning rate (namely the necessary sample size for given error parameters)! Theorem 17.4 [VC15] A class F is PAC-learnable if and only if VC dim(F ) is ﬁnite. Moreover, denoting VC dim(F ) = d,

1 1 1 • The number of required examples is T (F, , δ) ≤ O( (d log + log δ ) • Every algorithm which produces as hypothesis any function in F that is consistent with the sample, achieves the required error bounds.

Let us stress a few points. First, the sample size bound is independent of the sizes of the domain X or the target class of functions F ! In a precise sense, the VC dimension captures the “essential size” for the purpose of sampling from any distribution on X. Note that for constant error parameters , δ, the bound on the sample size is linear in the VC dimension of F ! Finally, this upper bound on the sample size T is best possible in all parameters, as proved in [KPW92]. This theorem has implications and interpretations beyond learning (and statistics, where it originated) to other areas, including discrete geometry (starting with [HW87]), discrepancy theory and combinatorics, especially the study of set systems (hypergraphs). The connections to them all, as well as the fundamental nature of the theorem, arise from a somewhat more abstract version of it using the language of -nets (see e.g. [Mat02, Chapter 10] for an exposition). For this view it is best to think of functions in F as indicator functions of subsets of X. For a distribution D, an -net is a subset of points in X which intersects every “large” set in F , namely one whose D-measure is at least . The theorem says that, for any F of finite VC dimension, sampling enough points from any distribution D will be an -net for D with high probability. Moreover, a similar statement holds if one requires a stronger notion, -approximation, namely a set whose intersection size with any set in F is within of its D-measure of that set. Using these connections, this theorem and its variants give uniform concentration bounds for potentially infinite (or even continuous) spaces X and function families F of finite VC-dimension. Let us say a few words about the proof of the theorem. The intuition for the proof comes from the fact that a finite VC dimension d allows us to think of F as small, even when infinite. Let us first see why a small sample suffices when F is small, and then see in what sense does the VC dimension captures this smallness. Let us assume for simplicity that we fix a failure probability δ to be some small constant, say .001. Our task is to show that for every f ∗ ∈ F , if we draw at random t points from D with t sufficiently large, any function f ∈ F consistent with f ∗ on that sample will agree with f ∗, with probability ≥ 1−δ, on all but an measure (under D) of X. Consider any f for which D(f 4f ∗) ≥ . Clearly the probability that the sample will miss that symmetric difference (and fail to distinguish

225 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

1 the two) decays exponentially in t, and so if t this event will happen with probability at most δ. To prove the theorem for a finite F , we could do a union bound over all possible f ∗, f ∈ F and log |F | obtain the same failure probability by taking t . The main point of Vapnik and Chervonenkis’ proof is that VC dim(F ) can (roughly) replace log |F | in the argument above, even when F is infinite. The reason is that if VC dim(F ) = d, on every finite sample size, say t, then the functions in F can label these t points in at most td different ways (compare to the trivial bound of 2t)261. This seems to suffice for a union bound, as we have effectively reduced the number of pairs of functions to tO(d), which would be dwarfed by the exp(−t) decay of failure probability to catch any single large symmetric difference. However, this idea does not quite work as there is a nagging dependence between the functions at hand and the chosen sample. This subtle issue is handled with a slick argument that the reader is encouraged to discover or read about262. Another challenge we leave you with is proving this most basic fact about VC dimension used above which we now state263. Lemma 17.5 [Sau72, She72] For any integers d ≤ t, let F = {f : X → {0, 1}} be any family of functions with |X| = t and VC dim(F ) = d. Then

t t t t |F | ≤ + + + ··· + . 0 1 2 d

17.4.2 Efficiency and optimization While the VC dimension completely determines PAC learnability in principle, it is of course critical to have efficient learning algorithms, as Valiant insisted in his original definition [Val84b], and as these are the only ones we can hope to implement. We seek an efficient algorithm in terms of the VC dimension, and the input and output size parameters (representation of an element of X, and a function from F ). Now the Vapnik-Chervonenkis theorem tells us that any hypothesis consistent with enough samples achieves PAC learnability. Let us check this in for some concrete target classes. Going over the examples in the list 17.4.1, it is simple to see that for the first 3 classes, efficient algorithms to find a consistent hypothesis exist264. On the other hand, it is not hard to prove that deciding if a set of positive and negative examples of a Boolean function have a size-s DNF, or a size-s Boolean circuit, are both NP-hard problems! So at least this obvious approach to efficient learning algorithms does not work in these cases. Note how convenient it is that PAC learning is equivalent to (the much simpler to understand) search for a consistent hypothesis with the data. This result naturally frames learning tasks as

261This ingredient of the [VC15] proof was independently discovered in combinatorics by Sauer [Sau72] and in logic by Shelah [She72]; we state this simple and useful combinatorial fact more precisely below. 262Insufficient hint: Partition the random sample into two random parts of equal size to create the required independence. 263Insufficient hint: use the following 2 steps. The easy one is proving the bound if F is “downwards closed”: every function whose support is contained in that of a function in F is also in F . The harder one is reducing to this case by iterated “shifting”: simultaneously remove some fixed x ∈ X from the support of every function in F for which this removal defines a function outside F . 264For 1, one can compute the minimal enclosing box of all positive examples by finding the minimum and maximum value in each coordinate. For 2, one can use linear programming. For 3, note that every positive example points to n of the 2n literals which cannot be part of the hidden conjunction, and can thus be eliminated. Repeating for all positive examples, the hypothesis which is the conjunction of all remaining literals will be consistent with the sample.

226 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

optimization problems, and adds to the many connections between these two ﬁelds. And as usual in complexity theory, tasks of ﬁnding approximately consistent hypotheses and other relaxations are part of this study as well.

17.4.3 Agnostic PAC learning One obvious shortcoming of the framework above is the assumption that the target class F is known, namely that we have substantial structural information about the phenomenon we are observing and trying to classify. This may be true in some cases, but false in many others. What happens if we drop this assumption completely? Note that in contrast to F , the hypothesis class H, namely the set of models we choose as possible “explanations” of the phenomena observed, is certainly within our control in science, and perhaps easier to deﬁne or bound even when considering the learning abilities of living systems. An important extension of the VC theorem is to a model called agnostic learning, in which only H is present. It is interesting and important in the many cases as above, when the target class F is unknown, or when the hypothesis class H does not necessarily contain F . What can be the goal of the learner in this model? Before, we knew that some function f ∗ in F labeled the data, and the learner’s goal was to approximate it with some hypothesis h ∈ H. Now f ∗ may be arbitrary. However, as only hypotheses in H are allowed, clearly the best one can hope for is doing as well as the best function h∗ ∈ H with respect to the data. How close can a learning algorithm come to that performance? As it turns out, the very same proof of Theorem 17.4 above shows that the VC dimension of the hypothesis class H plays the same role, and the same algorithm achieves the same performance in this general setting. Namely, any hypothesis h ∈ H consistent with the number of examples in this theorem will be -close to best one, h∗ under any distribution D, with probability at least 1 − δ. Indeed, it is this more general theorem that was proved in the original work of Vapnik and Chervonenkis (although the term “agnostic learning” came later).

17.4.4 Compression and Occam’s razor Some cognitive theories suggest that learning involves summarizing our life experiences in useful ways, where the stress is on summary, in contrast with just memorizing all of them. Similarly, scientists, after amassing data about some phenomena, attempt to summarize it into a much more compact scientific theory. Let us explore this possible connection between compression and learning, and possible formalizations of it in the framework of PAC learning. A famous quote of William of Occam, a 14th century English philosopher, is “entities should not be multiplied unnecessarily”. This became a basic principle of learning, and more generally of scientific discovery, which we today call Occam’s razor, that interprets the quote above as “among equally accurate explanations of the same phenomena, always prefer the simpler one”.265 While this principle sounds reasonable, it deserves an argument explaining the benefits of simpler explanations. As it turns out, PAC learning provides a framework in which Occam’s razor can be proved, in the sense that using it implies learning! This was suggested by Blumer et al. in [BEHW90] which we now explain.

265A well known response to the natural question of why Occam’s somewhat obscure statement was interpreted this way is that, well... it is the simplest possible explanation. Luckily, many other thinkers, as early as Aristotle, articulated this scientiﬁc principle more clearly much earlier.

227 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Let us restrict ourselves to proper learning (H = F ). The notion of simplicity we will use is the description length (in some canonical encoding) of functions f in F , and denote it by s(f)266. The following theorem states (roughly) that if an algorithm can always compress large number of labeled examples to a shorter consistent hypothesis, than the same algorithm PAC learns F . Theorem 17.6 [BEHW90] Assume that for some α < 1 and C > 0 there is a (compression) algorithm A with the following property: on any sample of m inputs labeled by any function f ∗ ∈ F , with m ≥ s(f ∗)C , produces a function f ∈ F which is consistent with the sample and s(f) ≤ m1−α. Then A is a PAC learning algorithm for F . The proof is simple, and uses the exponential (in m) decay of probability of missing a significant (under the given distribution) part of the space, together with a union bound on the possible number of functions with such small a description. Intuitively, this says that a simpler consistent explanation should be preferred, because it is more likely to be caught as incorrect if it is. This formal one-directional connection between compression and learning raises the question of a converse direction: does learnability implies compression in some formulation of these concepts? In their paper [LW86] Littlestone and Warmuth defined a parameter of arbitrary classes F , which we call here Comp(F ), capturing the compressibility of large labeled samples from F . Roughly speaking, Comp(F ) ≤ k if any sample (of any size m) of labeled examples can be compressed to a sub-sample of only k labeled examples plus an additional k bits of size information, in a way that allows complete recovery of the labels of the m − k “deleted” examples. Their main result, in the same vein as the paper above, is that here too compression implies learnability, as it simply bounds the VC dimension: VC dim(F ) ≤ O(Comp(F )). They asked if in one can prove any relation in the other direction. This took 30 years to resolve; Moran and Yehudayoff [MY16] proved Comp(F ) ≤ exp(VC dim(F )). Thus, the finiteness of one parameter implies the finiteness of the other, and compression characterizes learnability in this framework! We summarize these results here. Theorem 17.7 [LW86, MY16] There is a universal constant c > 0 such that the following holds. Let F be any class of functions with VC dim(F ) = d and Comp(F ) = k. Then k/c ≤ d ≤ exp(ck) It remains a very interesting problem to close that exponential gap.

17.4.5 Boosting: making weak learners strong The idea of boosting is one of the central ideas in machine learning, applicable beyond the PAC model where it was born. Roughly speaking, it is a way of creating highly accurate predictors from rules that just barely do better than guessing. The idea sounds preposterous, especially if you consider the possibility of using your favorite stock broker or weatherman, who perhaps can guess some bit (appropriate to their expertise) about tomorrow with (say) 51% probability, and turning their advice over time into a method that will let you succeed 99% of the time in the same prediction task. However, in quite general settings this is possible. This was ﬁrst proved in the PAC model in the breakthrough paper267 of Schapire [Sch90], and soon after simpliﬁed and improved by Freund [Fre90]. Boosting then rapidly evolved beyond this model and computational learning to optimization, statistics, game theory and beyond (some of these applications were noted already in the

266For example, there are simple binary encodings of various classes of circuits, formulae, ﬁnite automata, polynomials, geometric shapes, etc. 267Yet again, by a graduate student!

228 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

original paper, which also derives from it implications to the space efficiency of learning algorithms as well as the first NP-hardness result of learning tasks). We have seen incarnations of boosting already in two different contexts earlier in this book; online expert prediction in Section 16.2 and structure versus randomness in Section 8.8. Boosting is part of numerous practical systems, and is useful in scientific experiments. This theory of boosting and its scientific and practical applications are exposited in the excellent book [SF12] by the originators. Here we will restrict ourselves to the PAC framework. We will now fix a target class F and a hypothesis class H. Let us return to the definition of PAC learning. The quality of a PAC learning algorithm is governed by two parameters, , the accuracy and δ, the confidence. We wish to study the potential of improving the quality of these parameters. Making explicit their roles in the definition of PAC learning, let us call an (efficient) algorithm A an (, δ)-learner if for every distribution D, on sufficiently many independent examples labeled by some f ∗ ∈ F returns, with probability ≥ 1 − δ, an -accurate hypothesis h ∈ H, namely one satisfying that f ∗ 4 h has measure at most under D. We define F to be PAC learnable using hypotheses from H if such an (, δ)-learner exists for every choice of > 0 and δ > 0 (indeed, in the standard definition and δ are given as inputs to the learning algorithm as required accuracy and confidence parameters, respectively). However, suppose that someone provides us with a (0, δ0)-learner A for some fixed 0, δ0. Is there a way to use A to construct (efficient) learners with better parameters, and under what conditions? The answer is yes and always; learning under the weakest possible parameters implies learning with the strongest ones. 1 Theorem 17.8 [Sch90] For every 0 < 2 and δ0 < 1, an efficient (0, δ0)-learner for F with H implies efficient PAC learning of F with hypotheses H0, where functions in H0 are efficiently computable when those in H are. We will now argue the two parts of this theorem, first the simple amplification of confidence, and the deep and fundamentally important amplification of accuracy, called boosting. For both, we will focus only on these parameters, mostly ignoring effects on the cost in sample size and computational efficiency (for the simple reason that controlling them is rather routine). However we note that 1 these costs will only degrade polynomially in the gaps 2 − 0 and 1 − δ0 of these parameters from the trivial bounds. Let us treat one parameter at a time. Attaining any desired confidence δ > 0 is easy to achieve, starting from any δ0 < 1. The main idea is that labeled data can be used not only to train classifiers, but also to test their quality. So, consider running A k times, on independent samples, with k = O((log 1/δ)/δ0). This produces k hypotheses, h1, h2, . . . , hk. Now pick another (large enough) independent sample S, and test the quality of each hi on S. Finally, output hi for i ∈ [k] which made the fewest errors on S. It is not hard to see that this new algorithm is an (efficient) 268 (0, δ)-learner with the confidence parameter δ specified . How about improving the accuracy parameter? Note that this is far less trivial. To see this clearly, let us consider a “toy case” in which the given learner A has confidence 1 (equivalently δ = 0)269. Namely, on sufficiently many examples labeled by any f ∗ ∈ F , drawn from an arbitrary

268A sentence starting with these words is often false, as is the case here. But morally it is correct. The slightly uglier correct statement is that for any γ > 0 the above construction can yield (0 + γ, δ)-learner. Moreover, the dependence of k and |S| on 1/γ are polynomial, making the construction efficient. 269Actually, by the amplification of confidence above, this toy case is essentially as general as the general case, as we can drive δ as close to 0 as we wish. Assuming δ = 0 will release us from accounting the (minor) way in which this parameter deteriorates when amplifying accuracy.

229 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

distribution D, the given learner A always returns a hypothesis h which disagrees with f ∗ on at most 0 measure of D. How on earth can we produce a hypothesis which makes fewer errors than h? The answer lies in making full use of the PAC model. Recall that while we want to learn f ∗ under the distribution D, the learner A is guaranteed to successfully learn it under any other distribution D0. Schapire’s ingenious idea is to actually provide A with labeled examples drawn from other (judiciously chosen) distributions which will help identify points on which h errs and correct for them. You might now ask, how can we sample from other distributions? After all the distribution D generating examples is not under our control. To which Schapire’s answer would be, simply by filtering (or reweighing) examples arriving from D270. Let us see these ideas in action. The most natural way to proceed here would have been to describe and analyze the algorithm AdaBoost of Freund and Schapire [FS95], possibly the most elegant and practically useful boosting algorithm271. However, AdaBoost is described well in so many sources, and moreover its analysis is very similar (to the very related) on-line expert prediction algorithm described in Section 16.2. So instead of AdaBoost, we will describe here the original boosting algorithm of Schapire [Sch90], which is less well-known. While less efficient, its analysis is more intuitive, and moreover bears similarity to a very different amplification algorithm in circuit complexity, that of Valiant [Val84a] for constructing short monotone formulae for the majority function. 272 We will show how to use A, which is an 0-learner , to construct an 1-learner B, with 1 < 0. Iterating this construction will lead to a sequence of i-learners, with the sequence {i} quickly converging to 0. We will not analyze this simple convergence and the sample size and efficiency analysis, and just proceed to describe to analyze one amplification step. The learner B will behave as follows. It will feed A independent samples from three distributions specified below, D1,D2,D3, on which A responds with outputs hypotheses h1, h2, h3 respectively. Then B will output as hypothesis the function h which computes the majority of the hi’s (namely, 273 on every domain element x ∈ X, h(x) = Maj(h1(x), h2(x), h3(x))). The distributions are specified as follows. D1 = D, the original distribution. D2 rebalances 1 the probability of elements in D, so as to give equal weight 2 to those for which h1 is correct and 274 those for which it is wrong. Note that as we have h1 at hand this reweighing is easy. Finally D3 outputs only labeled examples from D for which h1 and h2 disagree (discarding all others). One can check that this sampling from D2,D3 can be done efficiently given samples from D. 1 The main quantitative claim is that if the accuracy of A satisfies 0 ≤ α < 2 , then the accuracy 2 3 1 of B satisfies 1 ≤ 3α −2α which is strictly smaller than α for α < 2 . The observant reader might have noticed that this formula is familiar: tossing a coin whose probability of Heads is α three times independently, the probability that the outcome will have a majority of Heads is exactly 3α2 − 2α3. Now think of hi(x) when x is sampled from D as three coin tosses; it is clear that each of them mislabels x with probability at most α. However, they may be far from independent (depending on A’s behavior). Despite this, the following simple argument shows that the worst (largest) probability

270As possibly corrupt casinos might do when making sure that the roulette ball lands in a random slot except those clients bet on in this round. 271The name AdaBoost comes from adaptive boosting—when amplifying the accuracy it does not even need to know the initial accuracy 0 of the given learner A. 272As discussed, we disregard δ, as it is set to 0. 273This already clarifies that the final hypothesis class H0 after iterations will be simple formulae in the functions in the original hypothesis class H. 274For instance, for each example, first flip a fair coin to choose “correct”/“wrong”, and sample labeled examples from D taking the first for which h1 agrees/disagrees with the label.

230 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

that h(x) mislabels x is when they are independent, namely is at most 3α2 − 2α3. For this analysis, divide the domain X to 4 parts: XCC ,XCW ,XWC ,XWW where the ﬁrst subscript encodes if h1 was correct or wrong, and the second encodes if h2 was correct or wrong. Let us denote the measures (under D) of these 4 sets by a, b, c, d respectively. Now we use the 275 promised accuracy of A on any distribution, in particular D1 and D2 . As h1 and h2 are each wrong with probability at most α on their respective distributions, we get (please verify) the following two inequalities:

d + b ≤ α, c/(2(1 − α)) + d/(2α) ≤ α.

Using these two inequalities we can bound the probability that h errs on D as follows. For the majority to be wrong, either x falls in XWW which has measure d, or it lands in the in the part of XCW ∪ XWC on which h3 was wrong, which is a fraction of at most α of that set. Thus, h is wrong with probability at most

d + α(b + c) ≤ [α(d + b)] + [(1 − α)d + αc] ≤ α2 + 2(α2 − α3) ≤ 3α2 − 2α3.

17.4.6 The hardness of PAC learning (and in particular, of DNFs) So, which classes of Boolean functions can be PAC-learned efficiently (in terms of their description size276)? Valiant showed in his original paper that the class of conjunctions (of literals and their negations) can. This is nice, as often we classify objects (animals, plants, preferred cities, homes, friends, etc.) by the presence and absence of certain features (each of which can be represented by a Boolean variable). But obviously this is a very primitive description of objects. Suppose we move one level up, and ask for disjunctions of conjunctions, namely DNF formulas? Surprisingly, this basic question which has now been under attack for decades is still open (and the general belief is that the answer is negative277). Here we discuss how one argues the hardness of a PAC-learning task, and how one deals with such hardness. Let us tackle these questions one at a time. The first to consider hardness results were Kearns and Valiant [KV94a] who made the following basic connection to cryptographic hardness. First, they noticed that random functions are hard to learn (even under the uniform distribution!). After all, by definition, seeing the value of a random function on a sample of inputs tells you absolutely noting about its value on any other input! Of course, this in itself is not such bad news, as random functions cannot be described succinctly. But now recall the cryptographic pseudorandom functions of [GGM86] (mentioned in earlier chapters on cryptography and on randomness), constructed under the assumption that one-way functions exist (see Section 4.5). This is a family of efficiently computed functions (each has a polynomial size circuit), but a random member of this family cannot be efficiently distinguished from a real random function. Thus, they cannot be learned either! So, the first message is that not everything which is efficiently computable is efficiently learnable! More generally, this establishes the following principle: if a class of functions contains pseudo-random ones (under certain complexity theoretic

275 Note that in D2 we reweigh every element on which h1 was correct by 1/(2(1 − α)), and every element on which h1 was wrong by 1/(2α) 276For natural classes of Boolean functions (e.g. by various circuits, formulae, branching programs etc.), their description size also bounds their computational complexity. Additionally, eﬃcient learning can only be done for succinctly described functions. 277You may recall that above 17.4.2 we mentioned that computing a DNF formula of a given size consistent with a given sample is NP-hard, but of course this is only a suﬃcient condition for PAC learning.

231 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

assumptions) then it cannot be PAC learned, even under the uniform distribution. Kearns and Valiant [KV94a] give some other examples of such classes, and Kharitonov [Kha93] extends their results to very low complexity classes. But short DNFs are extremely simple functions, so what does this approach tells us about their learnability? It is not hard to see that if we only care about learning under the uniform distribution, there is a simple algorithm which learns DNF formulae of size n in quasi-polynomial (nO(log n)) time278. On the other hand, the best known PAC learning algorithm (for arbitrary distributions), due to Klivans and Servidio [KS01], takes mildly exponential (roughly exp(O(n1/3))) time279! The hardness of PAC learning k-DNFs was first considered by Pitt and Valiant [PV88], who showed that for proper PAC learning (namely when the hypothesis class should itself be k-DNF formulas), the problem is NP-hard (under randomized reductions). This was extended to the hardness of proper learning of DNFs by DNFs in [ABF+08]. But proper learning is an unreasonably strong demand of a learner, and indeed the best known algorithms are not proper (both [KS01,Jac94] produce hypotheses which are polynomial threshold functions). Only recently, Daniely and Shalev-Shwartz [DSS14] finally proved general PAC learning hardness under a natural and reasonably well-studied average-case hardness assumption: that no fixed polynomial-time algorithm can refute random k-SAT formulae for growing k (see the paper for the precise assumption and the many results supporting it). While we have focused on DNFs, many other very simple function classes are known or suspected to be hard in the PAC model (sometimes in the agnostic or noisy variants). Many other learning models (with added features like query access, or more forgiving error measures for non-Boolean labels) besides PAC exist, and are realistic in many situations; some of these, for some of these simple problems, do have provably efficient learning algorithms. But these are so far from explaining the empirical success of humans, animals and many heuristics in learning much more complex functions under unknown (and sometimes even varying) distributions. This dichotomy, the efficiency gap between various heuristics on “real life” instances on the one hand and algorithms with provable guarantees on the other, goes far beyond learning theory to algorithms and optimization. Building models which better capture real-life inputs and problems remains a major challenge of computer science as a whole. But in machine learning especially, recent progress in training “deep networks” to learn highly complex structures seems to be pushing the field into accepting (certainly for working systems) successful heuristics even when we have no idea what they are doing and how. The impact of this trend on the nature of the field has yet to be seen! It is thus good to conclude with a concrete mathematical open problem for which I believe there should be a provable result. It is a very special case of DNF learning, under the very special uniform distribution. It was suggested by Blum [Blu94], and captures yet another basic problem of learning: the elimination of irrelevant features. Let Fk be the class of Boolean functions on n bits, which actually depend on at most k of their input bits. Can the relevant (and irrelevant) bits be efficiently detected from uniformly random labeled examples280? Note that for constant k one can efficiently learn Fk by trying all possible subsets, and that for k ≤ log n, Fk is a subclass of linear size DNF formulae. 278And in a somewhat more general model which allows the learner to ask queries, Jackson’s celebrated Harmonic Sieve algorithm [Jac94] (which cleverly uses boosting) can learn DNFs under the uniform distribution in polynomial time. 279Via a clever reduction to learning hyperplanes in these many dimensions, by showing that DNFs of size n can always be represented as the sign of a real polynomial of degree roughly O(n1/3). Incidentally, this degree bound is tight by a result of Minsky and Pappert [MP69], an important early text in computational learning theory. 280Clearly any learning algorithm will in particular reveal this partition.

232 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Open Problem 17.9. Find a polynomial-time algorithm for learning Fk under the uniform distribution for any k growing with n (or argue hardness using a natural complexity assumption). An interesting trade-oﬀ is proved for this problem in [KRT16]: for k = log n, any learner needs a superpolynomial number of samples, and hence superpolynomial time, assuming it has only linear size memory O(n).

233 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

18 Cryptography: modeling secrets and lies, knowledge and trust

Cryptography is a truly vast field. It serves as a foundation of its more practical sibling of computer security, which employs numerous computer professionals around the globe and is a major part of the computer industry. Cryptography is also directly connected to the very related but distinct field of digital privacy, always in the news for obvious societal concerns, for which a beautiful new theoretical framework has recently been developed (see e.g. the surveys [DR14, Vad16]). A comprehensive text on the modern foundations of cryptography is Goldreich’s two volumes [Gol04]. We have discussed aspects of cryptography a few times in this book, as it provided important notions and directions of study in computational complexity. We presented the most basic assumptions of complexity-based cryptography, namely one-way and trap-door functions, in Section 4.5. We discussed the cryptographic origins of pseudo-randomness in Section 7.3 and the concept of zero-knowledge proofs in Section 10.2. In the following overview we would like to focus on more general aspects, especially the complex mathematical modeling of cryptographic situations and some of its principles. In particular we will highlight the axioms underlying modern cryptography, variety of tasks and constraints, basic primitives, design paradigms in modeling these, the key use of randomness and computational indistinguishability, and the fertile interaction between the complexity-theoretic and information- theoretic viewpoints, techniques and results. After this hefty material, which is mainly “classical”, we will briefly describe three cryptographic tasks on which there was exciting recent progress. After describing this elaborate and beautiful theory that underlies computer system security, we return to reality, and conclude with a discussion of physical, rather than mathematical, attacks on practical cryptographic systems.

18.1 The ambitions of modern cryptography For millennia, cryptography (or cryptology), as a human activity, has focused on the sole purpose of the literal meaning (in Greek) of these words: secret communication281. The main ambition of the field was designing codes which will allow certain parties to exchange private messages, while preventing others from understanding them (and from the other end, the main ambition was the breaking of such codes282). Secret communication was (and is) a hugely important goal in plenty of contexts. We will not discuss the rich history of this ancient field; two comprehensive popular books which do are [Sin11,Kah96]. Rather we’d like to point out that secret communication is but one (important) task in which one needs to enable and protect privacy and integrity. The ambition of classical cryptography was focused in this one task. But in numerous human activities enabling and protecting privacy and integrity presents a challenge. You’d like no one to be able to read your secret diary (or files). You would like to withdraw cash from your bank account, but no one else should be able to. You’d like to cast your vote, but should not be allowed to vote twice. You’d like to hold a private conversation with a friend which no one should be able to understand. You’d like to place a bid without your competitor bidding $1 less 1 second later. You’d like to play Poker without the other players peeking into your hand, or keeping aces in their sleeves. The list goes on and on. The ambition of modern, complexity-based cryptography is to address all such tasks (and more. . . ).

281The literal meaning is “secret writing” for cryptography and “the study of hiding secrets” for cryptology. 282Often called cryptanalysis, which in Greek means “uncovering the hidden”.

234 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Having to deal with all these complex situations in which the tension above is present, humans developed a vast array of physical means, typically task specific, like playing cards, sealed envelopes, supervised ballot stations, big locks on thick safes, official bank notes, ID cards, etc. Modern cryptography allows no physical means whatsoever. We want to achieve everything as above, but the only “objects” “possessed” by individuals are information bits, and the only actions are digital communications between computers (or, equivalently, verbal communication between people)! Despite (or because of) these severe limitations, the seemingly impossible ambitions above were found to be possible through the theory of modern cryptography. The confidence to “ask for the moon” evolved for about a decade, from the late 1970s to the late 1980s, when successively varied and more difficult tasks were found possible in the new framework. It should be stressed that these developments happened before the Internet arrived on the scene, and indeed enabled, upon its arrival, making e-commerce possible! Modern cryptography is a great example of the incredible economic consequences of curiosity-driven research. We will soon lay out the complexity-theoretic axioms underlying modern cryptography, but first we contrast the information-theoretic and complexity-theoretic viewpoints.

18.2 Information theory vs. Complexity theory: Take 1 Let us go back to the secret communication problem (which we shall return to again and again). All solutions invented for it through the ages had a common feature—the two communicating parties secretly share some piece of information (sometimes called a key) which the eavesdroppers did not have. In other words, it was always assumed that the communicating parties had (somehow) solved an earlier secret communication problem, namely the secret communication of that key! This was an underlying axiom of classical cryptography, which we shall strive to eliminate. Shannon, in one of the earliest applications of his just-developed “mathematical theory of communication” (which we call today Information Theory), sought to investigate precisely the need of this axiom, quantitatively. In his paper [Sha49b] formally defined the notion of perfectly secure secret communication system, and proved that in any such system, secretly sending an n-bit message requires the pre-agreement of a perfectly random n-bit key. Namely, for each bit you want to communicate privately in the presence of eavesdroppers, you must pay with a one bit communicated somehow without them present. So provably, this axiom cannot be eliminated! Or can it? Probing deep to the proof of Shannon’s theorem, one realizes that it relies on the following, completely reasonable (and seemingly benign) axiom of the information theoretic view: all representations of a random variable are equally useful. More precisely, if X is a random variable on some set S, and f : S → T is any bijection from S to another set T , then for all purposes of information theory, the random variable Y = f(X) is equivalent to X. To do what we have to do, namely eliminate the need to privately communicate first in order to privately communicate later, we have to remove this axiom of information theory. The next section describes the axioms of modern, complexity based cryptography, which form its foundation. But first, to illustrate the difference between the two viewpoints, consider the following example first. Fix a large number n, and define a probability distribution by picking, uniformly and independently, a pair of n-bit primes p and q. Consider the following two random variables X and Y defined by X = (p, q), and Y = p·q. Now, suppose I offer you one of them—which would you choose? Infor- mation theoretically, these two random variables are equivalent: the value of one uniquely defines the value of the other (by unique factorization). So, it is two for the price of one, and you shouldn’t care which you get. Unless. . . time is of the essence for you, and of course it is, for everyone. From

235 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

a computational perspective there is a huge difference between the two choices. Y can be obtained from X efficiently via multiplication, whereas to obtain X from Y is equivalent to factoring, which is currently impossible to do efficiently. This asymmetry is the fundamental difference between the two viewpoints, and what allows numerous feats which are information-theoretically impossible to become possible in the complexity-theoretic model.

18.3 The axioms of modern, complexity-based cryptography Modern, complexity-based cryptography, initiated in the seminal283 paper of Diﬃe and Hell- man [DH76], makes the impossible possible by introducing two complementary “axioms”:

• Axiom 1: All participants in cryptographic protocols are computationally bounded algorithms.

• Axiom 2: There are computational problems that cannot be solved by such algorithms.

We recall before proceeding that both information-theoretic and complexity-theoretic cryptography share a common axiom, which perhaps should be called Axiom 0, namely that all participants have access to perfect randomness.284 • Axiom 0: All participants in cryptographic protocols can generate an unlimited number of independent, unbiased coin tosses. Let us discuss these “axioms” before starting to use them. Of course, none of these axioms are as self-evident as some familiar mathematical axioms285. But a billion users of cryptographic systems that are based on these axioms, implicitly put their trust in them—here not mere abstract truth is at stake, but rather your privacy or fortune. Axiom 0 is at least well defined. It is the same one underlying probabilistic algorithms. While for efficiency of algorithms it may not be essential (as discussed in Chapter7), for cryptography, randomness is essential, as the very notion of a secret (and all other notions) cannot even be defined without randomness. We have discussed randomness in earlier chapters, and in particular coping with situations when it is not perfect (as we assume). We note that in cryptography this is a bigger worry than in algorithms (as it can impact security), but we shall not address this issue here. We assume Axiom 0 as is. Axioms 1 and 2 require more elaboration. They are not precisely defined, and indeed may be chosen to depend on the actual environment and application. For Axiom 1, this freedom is actually a source of modeling power; it allows putting different limitations on different resources (which may differ for different users) as the real-life situation at hand seems to demand. Axiom 2 should match Axiom 1, as the security of a system will rest on this intractability assumption. Before choosing which, let us reflect first on why we actually need an intractability assumption at all. Sure, it would be great to have unconditional security proofs, not relying on any unproven intractability

283The word “seminal” will appear many times in this chapter; no occurrence is taken lightly. This particular paper, besides the scientiﬁc and technological revolution it initiated, is an extremely lucid account of basic issues and ideas and their history—a must-read model of scientiﬁc writing. 284Relaxations of this axioms, when only “imperfect” randomness is available, was explored in cryptography and more generally in computation. We discussed modeling weak random sources and coping with them in Chapter9. 285However, recall that also the axiomatic foundations of mathematics itself, on which “absolute truth” of theorems is based, have been and are still debated.

236 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

assumption. But for practically all cryptographic systems ever designed, breaking them is an NP problem286, and so proving their security will imply P= 6 NP287. So, we must make hardness assumptions, and a diﬃcult question is which ones are acceptable. It would have been great to rest cryptography on P 6= NP, but we have no idea how to. Con- crete suggestions like the hardness of factoring seem excellent, as it is mathematically elegant, has withstood centuries of attacks288, and is independent from the applications. But it may turn out to be an easy problem. This central question, of which assumptions are acceptable, is a subject of constant debate (especially given the wealth of assumptions this ﬁeld has generated), and excellent papers suggesting concrete criteria for acceptability are [Nao03, GW11, GK16]. In this chapter we focus on the most common choices. Namely in Axiom 1 we limit all participants to polynomial-time computation, and we strive289 to make Axiom 2 as general as the existence of trap-door functions290 (see Section 4.5).

18.4 Cryptographic definitions It is hard to convey the difficulty of precisely, mathematically defining cryptographic tasks and cryptographic protocols for them. Indeed, to get a real sense, one has to work in this field, or at least honestly delve into their details in different chapters of [Gol04], for example. Indeed, the advertisement above, that modern cryptography can achieve seemingly impossible goals, crucially depends on choosing the right definitions, which often are subtle and arrived at after subtle flaws were discovered in more naive initial ones. We will try to give you an idea of some of the sources of these difficulties. First, unlike computation, which is typically performed by one algorithm that has the full problem input, here there are many interacting participants, each having part of the combined input. How do those algorithms communicate? By pairwise communication, or broadcast mechanism? Can bad players eavesdrop? Corrupt messages? Collude in groups? All these decisions are crucial for accurate modeling of the desired application, as well as for the feasibility of a protocol. Second, unlike computational tasks, in which the desirable goal is almost always a correct answer, cryptographic tasks come with a huge variety of desiderata. Moreover, as some of the players may execute other algorithms than are required by the protocol, defining these properties requires nested alternations of quantifiers over the inappropriate behavior of bad players. We demonstrate these issues by a few examples of some cryptographic tasks. All of these were considered, formally defined and proved possible in the 1980s, way before the Internet! It is an excellent exercise for you to try and come up with some semi-formal definitions for their intuitively stated requirements. Feel free to use the axioms, and we stress again how they change the notion of perfect secrecy: what a player cannot efficiently compute from the information she has, is perfectly hidden from her. We note that in tasks with many participants, one has to specify the communication network between them. Throughout we assume a broadcast model, where everyone can hear what anyone

286Simply because one can guess the randomness and private inputs/keys of all participants. 287The optimism of the late 1970s is explicit in Diffie and Hellman’s paper; they cite the recent advances in computational complexity, especially the discovery of NP-completeness, as a central motivation for their complexity- based cryptography, and naturally hope that this field will soon produce intractability results! 288Gauss is on record for trying hard, but he certainly was not the first. As we mentioned in the prelude even Euclid’s GCD algorithm is the result of frustration with the difficulty of factoring when simplifying fractions. 289In many cases initial security proofs for concrete systems rest on stronger assumptions, which were relaxed in later works. 290Which is of course implied by the hardness of factoring, but is far more general and thus may survive if factoring is easy.

237 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

says (imagine they are in the same room, or indeed on the Internet); in this model it is hardest to protect against information leaks.

• Secret communication: Alice and Bob, who may have never met before, want to exchange messages with perfect ﬁdelity, so that Eve, who has full access to their communication, cannot extract any information about these messages from it. In other words, Alice and Bob should publicly create a private language291. • Message authentication/digital signature: Alice and Bob, who may have never met before, want to exchange messages with perfect certainty of their origin, so that Eve, who can inject messages into their communication line, cannot impersonate either of them.

• Secret exchange: Alice has a secret SA and Bob has a secret SB. A protocol must ensure a fair exchange: Alice learns SB if and only if Bob learns SA, and if they both follow it, both do292. A similar “synchronization” issue arises in other tasks, e.g. contact signing. • The Millionaires’ problem: Alice and Bob wish to find out who is richer, without any other information about their respective fortunes leaking to the other. • Zero-knowledge proofs: Alice attempts to convince Bob that she has a proof of a mathematical statement known to both. If false then Bob rejects their conversation, and if true Bob accepts it but learns nothing from it beyond the truth of the given statement. • Collective coin flipping: A set of mutually distrusting parties wish to jointly toss and agree on a fair coin, which none of them can bias. A related problem is agreeing on a random “leader” among the set. Note that subsets of bad players may collude! • Elections: A set of mutually distrusting players, each with a binary preference, want to compute their majority vote (namely, if there are more 1’s or 0’s), maintaining the complete privacy of all votes (except what is revealed by the majority outcome293). • Mental Poker: A set of mutually distrusting parties wants to play a full game of Poker (say, by Texas Hold’em rules) without cards or other physical means, from the random distribution of hands and betting rounds to the final decision of who won and how much (without revealing anything else about the players’ hands or strategies).

If this is not enough, an enormous layer of complications is added if agents are simultaneously engaged in different protocols with different sets of agents, but are free to use the information from all in their interactions! Despite this huge variety of tasks and adversaries, an elegant theory was developed which allows both the formal security definitions and the design of protocols satisfying them for essentially any reasonable cryptographic task. Let us slowly exposit some of the key ideas leading to this understanding. It should not be surprising that reductions and completeness will play an important role. We begin with the most basic problem of cryptography, secret communication, which we discuss in some detail. 291This “impossible” task is what your computer easily performs with e.g. Amazon’s computer, over the public Internet, before sending it your credit card number, so it had better work. 292Without the last demand a perfect protocol would instruct them both to hold their tongues. 293E.g. if three people participate, I voted 0 and the majority outcome is 1, I automatically learn that the other two voted 1.

238 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

18.5 Probabilistic encryption There is no better place to start this explanation than the seminal paper of Goldwasser and Mi- cali [GM84] entitled “Probabilistic Encryption”. This paper is the first to introduce precise mathematical definitions of cryptographic security and design protocols satisfying them under hardness assumptions. The language, framework, ideas and techniques in this paper, as well as the insistence on the most stringent possible security definitions became a model for the many thousands (no exaggeration!) of crypto papers that followed. This paper aims to solve the first cryptographic task in the list above, secret communication. The foundational ideas addressing this task, namely the public-key encryption of Diffie and Hell- man [DH76] and its instantiation based on the hardness of the RSA [RSA78] and factoring [Rab79] functions, were already known. These schemes provide a way for Alice to encrypt her messages so that Bob can decrypt them (and vice versa), while the ability of Eve to decrypt these messages entails an efficient algorithm for the assumed hard problem (which is impossible). But as Goldwasser and Micali point out in their critical analysis, these encryption schemes neither protect against the complete decryption of some messages by Eve, nor do they protect against Eve obtaining substantial partial information about every message from their encryption. This paper instead aims to allow Eve absolutely nothing! How to define this? The opening of their paper quoted next says it most clearly:

“This paper proposes an encryption scheme that possesses the following property: Whatever is eﬃciently computable about the cleartext given the ciphertext, is also eﬃciently computable without the ciphertext.”

This property is formalized in the paper under the name semantic security, and is suggested as a computational analog of Shannon’s information theoretic notion of perfect security, described in his seminal paper on information theoretic cryptography [Sha49b] mentioned above. Roughly speaking, semantic security demands that for every possible distribution on any finite message space, and for every function f on that space, the following holds. The a posteriori probability that Eve computes f(m) after seeing an encryption of a random message m is essentially the same as the a priori probability of f(m) over the original distribution. Of course, in the computational setting, this holds under the Axioms 1 and 2 above. In contrast, Shannon proves that perfect security in the information theoretic setting requires Alice and Bob to have shared information (and so the task as defined is impossible in this setting). Indeed, Shannon proves using his recently developed information theory that Alice and Bob must share a random sequence whose length is at least the entropy of the underlying message distribution (this amount is sufficient as well, as the two parties can use the so-called one-time pad). In the computational setting no shared information is needed to achieve perfect security as the paper [GM84] proves. This paper also suggests another notion of security, called the polynomial security which is easier to argue about, and is proved equivalent to semantic security. Here there is no distribution on the message space, and no auxiliary function to worry about. Simply, for every two possible messages, known to Eve(!), she cannot tell their encryptions apart with probability significantly better than random guessing. It is good to reflect on how these extremely stringent security demands actually force the encryption scheme of Goldwasser and Micali to be drastically different in nature from all past encryption schemes, namely to be probabilistic, as the paper title proclaims294. Consider a message space which

294Note that while randomness is of course an essential part in many past encryption schemes, in particular all

239 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

contains only two possible messages (say 0 and 1). As Eve sees all communication between Alice and Bob, she can apply Alice’s algorithm to 0 and 1 just as well as Alice could295. If encryption is a deterministic function of the plaintext message, as in past encryption systems, then Eve should have no problem distinguishing the two encryptions. The key idea of Goldwasser and Micali is that these encryptions would be chosen at random, from an exponentially large space! In this case Eve’s strategy above is useless. It remains to argue how can Bob figure out the message. The idea behind this first fully secure public-key encryption scheme (omitting many important details) is simple. As in RSA and Rabin’s scheme, Bob chooses (as his private key) two random n-bit primes296 and sends their product M (which is the public key in this system) to Alice. To encrypt 0, Alice sends Bob a random quadratic residue modulo M, and to encrypt a 1 Alice sends Bob a quadratic non-residue modulo M. The factorization of M available to Bob makes it easy to determine which is the case, but without this trapdoor information Eve is powerless to tell the two distributions apart with higher probability than just random guessing (despite the fact that they have disjoint support, and so information-theoretically easy to distinguish!). This Quadratic Residuosity Assumption (QRA) was the Goldwasser-Micali instantiation of Axiom 2, but later papers showed how to base such secure public-key encryption schemes on any trap-door function. Note that QRA is a statement about computational indistinguishability as discussed at length in Section 7.3, which became a cornerstone of cryptographic security definitions and proofs297. We note that “perfect security” as above, despite its name, may turn out not to be always sufficient (or rather has to be more specifically defined), as some applications may demand stronger notions, or extra properties. This is one force that has been driving the field, demanding new definitions and protocols. Examples of such stronger security definitions (and public-key encryption schemes achieving them) that were subsequently developed to answer further constraints include deniable encryption [CDNO97], non-malleable encryption [DDN03] and encryption resisting chosen ciphertext attacks [NY90], whose names suggest some of these extra properties.

18.6 Basic paradigms for security definitions: simulation and ideal functionality After this long discussion of the problem of secret communication and the standards it sets for security definitions, let us consider some of the other tasks mentioned above, and start drawing some general conclusions. These will lead us to the (related) simulation paradigm and ideal functionality paradigm, whose combination is central for security definitions and proofs, which evolved in the 1980s and are by now second nature to cryptographers. A recent excellent survey on the subject is [Lin17]. those mentioned above, it was used only for key generation. Once a key is chosen, the encryption of any message using that key is deterministic. 295This uses another basic principle, already codified by Kerchoffs in 1881 (see e.g. [Kah74, p. 235]), which states that the compromise of a cryptographic system should cause no inconvenience to the correspondents. In plain (or modern) words, this means that for security analysis, each participant of a cryptographic protocol can be assumed to know the algorithms used by all others (but not their private inputs or random coin tosses). 296n is called the security parameter of the scheme, an auxiliary input according to which computational complexity is measured. 297Recall that, not at all coincidentally, the seminal work on computational pseudo-randomness [BM84, Yao82a] was done at the same time and place—UC Berkeley, where Goldwasser and Micali were graduate students.

240 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

The simulation paradigm Let us recap, formalize and then greatly generalize the informal way in which [GM84] states the security of their encryption scheme: Whatever is efficiently computable given the ciphertext, is also efficiently computable without the ciphertext. Their protocol sketched above specifies the conversation between Alice and Bob if she wants to send him a secret message (say 0 or 1). Note that the security statement does not merely demand that Eve cannot learn Alice’s secret message from the conversation, nor that she cannot figure out Bob’s private key. It demands that everything she can do after the conversation, she could do without it! And we really mean everything. The conversation between Alice and Bob, beyond completely protecting their secrets, can’t help Eve solve any possibly unrelated problems, like factoring the integer M + 2, or find love. How can one ensure such a strong property? As often happens, proving general statements may be easier than specific ones, and more telling. The following would surely do to ensure it: let us demand that Eve generates the conversation between Alice and Bob by herself, without listening to them. If she can do that, surely listening to them doesn’t teach her anything she didn’t know! The meaning of this requirement from Eve is now the key to everything. First, recall that the conversation is probabilistic. Namely, there is a probability distribution on binary sequences, say D, which is defined by Alice’s and Bob’s secret inputs and randomness, and the actual conversation between them is one random sample from this distribution. So, a first attempt is demanding Eve to sample from D by herself. This will surely do, but of course is impossible (it is at least as hard as guessing Alice’s message bit without any information298). The next best thing (which in our computational world set by Axiom 1 is equivalent), is demanding that Eve samples from any distribution D0 that is computationally indistinguishable from D. Recall from Section 7.3 on pseudo-randomness that D and D0 are computationally indistinguishable, denoted here D ≈ D0, if no efficient algorithm can tell them apart with probability better than random guessing299. Now this is really easy, as Eve doesn’t need Alice’s or Bob’s secrets for that task. She can pick two random n-bit primes by herself, multiply them to create M 0, the first part of the conversation (so far identical in distribution to that part of the actual conversation). Now what? Simple. She picks a random quadratic residue modulo M 0 as the second part. Namely, she is simply encoding a 0 as Alice would. This would be fine (indeed identically distributed) to the actual conversation if Alice’s secret message was 0. But what if it was 1? No problem! The intractability assumption (choice of Axiom 2) underlying the [GM84] protocol was precisely that these two distributions, a random quadratic residue and a random quadratic non-residue, modulo a product of two random primes, is computationally indistinguishable! And thus D ≈ D0. Let us now address a subtle issue. How can we “demand” that Eve does anything? Eve is some unknown algorithm that certainly does not cater to our wishes. What this demand formally translates to is the following requirement, which explains the word simulation. The security requirement is that for every efficient algorithm Eve, there exists an efficient algorithm (the simulator) we call Eve0, that can generate D0. And this simulation constitutes the reduction300 from the security of the encryption scheme to the intractability assumption. Spelled out, by the intractability assumption, anything Eve could do with D, Eve0 can do with D0, without any access to the conversation. Which is precisely what the promise “Whatever is efficiently computable given the ciphertext, is

298This follows from the fact that Alice’s encryptions of 0 and 1 have disjoint supports. 299Again, the most common choices deﬁne “eﬃcient” to mean polynomial time in the security parameter n, and “non-negligible” to mean vanishing faster than inverse polynomial in n. But other choices work as well. 300An important issue we will not get into here is how this reduction operates: in most reductions the simulator Eve’ uses the algorithm Eve is a black-box fashion. This was believed to be completely general, until Barak [Bar01] found an ingenious non black-box reduction. Such simulations allowed proving much stronger theorems in various settings.

241 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

also efficiently computable without the ciphertext” means. The task of secret communication is simple from several points of view. First, there is only one (identified) possible adversary, namely Eve, who is not a real participant in the protocol, and has no inputs or information related to it. Second, here we were already given a protocol, and so it was quite obvious what to demand of the simulator to do; however typically cryptographic tasks are defined before they are solved. To deal with these issues in more complex situations, we move to the next paradigm.

The ideal functionality paradigm Let us consider a few of the other tasks from the list above and see what would be natural to demand the simulator to simulate in each case (focusing on the essence and ignoring many details). Then again we’ll generalize it to a paradigm. For each we recall its informal deﬁnition before discussing the simulation.

• Zero-knowledge proofs: (see also Section 10.2) Alice attempts to convince Bob that she has a proof of a mathematical statement known to both. If false then Bob rejects their conversation, and if true Bob accepts it but learns nothing from it beyond the truth of the given statement. Let’s deal only with the zero knowledge aspect of this task. (One should also deal with the fact that this is a proof, and in particular its soundness: Alice should not be able to cheat Bob into believing a false statement.) Zero knowledge demands that if the statement is true, Bob does not learn anything from the conversation between them except that truth. What should that mean? As before, we demand that Bob, given a true mathematical statement (say s), would generate, by himself, the conversation he and Alice would have on joint input s (which should be a convincing argument of that truth!). More precisely, the security requirement is that for every efficient Bob301 there is an efficient simulator Bob0 that for every such input s can sample from a distribution that is computationally indistinguishable from the one Alice and Bob would have on s. Note that there are two differences from the secret communication example. First, Bob has an input; but of course Bob0 has access to that input as well. Second, Bob is allowed to learn something, namely that the statement s is true (when it is). This is handled by demanding the existence of a simulator only for such inputs! Another issue regards the following typical confusion. Why do we demand a simulator for every algorithm Bob? After all, Bob is now a participant, and his actions are dictated by the protocol (unlike Eve above who was a “free agent”). The answer is that security demands should take into account all eventualities, specifically the possibility of players not following protocol. Note that Bob has much more power than Eve above. He actually communicates with Alice. So, if bad, he may decide to ignore the protocol and send messages which may cause Alice to leak information, either about the proof, or about anything else Bob didn’t originally know and wants to. As before, requiring a simulator for every algorithm Bob ensures that such deviations cannot violate the zero-knowledge property. Finally, note that we have only completed the formal security definition for zero-knowledge proofs. How to construct a protocol meeting this seemingly impossible task is a different challenge altogether. A protocol giving zero-knowledge proof for every mathematical statement in NP, was described in [GMW91] and is discussed in Section 10.2.

301Namely someone interacting with Alice as Bob who may not follow the protocol.

242 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• Millionaire’s problem: Alice and Bob wish to find out who is richer, without any other information about their respective fortunes leaking to the other. We are seeking an interactive protocol for which Alice and Bob, on any (respective) inputs x and y (say integers between 1 and M), to learn GT (x, y) (a bit defined to be 1 if x is Greater Than y and 0 otherwise) but nothing more. The security definition is again similar here. Let us spell it out. Here each of the players should have a simulator. For every efficient Alice we’d like an efficient simulator Alice0 that does the following. On any input x and a bit b, Alice0 samples from a distribution that is computationally indistinguishable from the conversation Alice would have with Bob on any y satisfying GT (x, y) = b. The demand for Bob’s simulator is analogous. Again, a protocol will specify algorithms for Alice and Bob, but by demanding a simulator for every possible efficient algorithm “impersonating” any of them we achieve security even if either of them deviates. We note that an interesting issue in this task (and many others), which we ignored here, is how to define security (and even the output value) if one of the parties terminates communication before completion, namely before GT (x, y) was computed by both. As before, this is just a security definition, and finding a protocol meeting this impossible- looking task is a nontrivial challenge, even for perfectly honest players! Think about it. . . A protocol for this task was given by Yao in [Yao86], and we will discuss it shortly. • Elections: A set of mutually distrusting players, each with a binary preference, want to compute their majority vote (namely, if there are more 1’s or 0’s), maintaining the complete privacy of all votes (except what is revealed by the majority outcome itself). This is getting complicated, and so we’ll ignore many issues, like preventing participants from voting twice etc. We focus on privacy: what should be the formal meaning of the intuitive statement that privacy of the votes is preserved after the majority value is revealed to all. For example, supposed there are 5 participants, two vote 0, three vote 1, and so the majority value is 1. Let us consider a few scenarios to arrive at a plausible definition of privacy. Suppose the two 0 voters get together at the end of the protocol and reveal to each other their vote. They immediately conclude with the perfect knowledge that each of the other voters must have voted 1. Does this violate the privacy requirement? It clearly doesn’t, as this would happen even in an ideal world, in which a trusted party (with a secure private channel to each player) would collect all votes, compute the majority and announce it to all. On the other hand, if two of the 1 voters got together and revealed their votes to each other, all they can conclude is that there is at least one more 1 vote among the remaining 3 participants (which they would learn even in this ideal world), but must not know anything more. There are plenty more scenarios even with 5 players, let alone more. Should we list all these possible scenarios in the privacy requirements of an election protocol? The answer is no! There is a very concise way to describe all these conditions, which is suggested by the hypothetical trusted party mentioned above. The ideal functionality paradigm asserts that the privacy in the real protocol (where there is no trusted party) should strive to match that of the ideal protocol (in which the trusted party communicates privately with each player and solves the problem for them). For elections, this generalizes the Goldwasser-Micali maxim for secret communication to the following security requirement: What a subset of players learns by participating in the election protocol, it could learn from participating in an election with a trusted party. As in the original, this statement must hold for all possible inputs to the players. So now the analogous security definition, for any fixed subset of players, is the following:

243 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

For any set of eﬃcient algorithms these players run, there exists an eﬃcient simulator, that for every input values to this set, and a given majority outcome (hypothetically received from the trusted party), samples from (a distribution indistinguishable from) the actual transcript of the protocol. A protocol achieving such security, for all subsets comprising less than half of all players302, was developed in [GMW87], and will be discussed soon as well. I hope you see a pattern forming here—this paradigm captures neatly and perfectly the other (simpler) examples we have seen so far. The security requirement for zero-knowledge proofs is what you get if a trusted party received an alleged proof from Alice for the statement s, checked it, and told Bob if it does or does not constitute a valid proof. Similarly, the security requirement for the millionaires problem is what you get if Alice and Bob respectively send x and y to the trusted party, who computes GT (x, y) and announces the answer to both.

• Mental Poker A set of mutually distrusting parties wants to play a full game of Poker (say, by Texas Hold’em rules) without cards or other physical means, from the random distribution of hands and betting rounds to the final decision of who won and how much (without revealing anything else about the players’ hands or strategies). We ignore many complications and details here, and focus on the high level message. This cryptographic task is far more complex than voting. Nevertheless, the ideal functionality paradigm should guide us to the formulation of a security definition. All we have to imagine is a trusted party with a secure channel to each player who is running the show according to the rules of the game. Given this specification, the security requirement for the actual protocol (for any particular subset of players) is that anything they learn by participating in the real protocol they could already learn in that ideal implementation. And again, demanding a simulator for that subset would guarantee that requirement. A two-party Poker protocol follows from [GM82, Yao86], and for any number of players in [GMW87].

Summarizing all we have seen, the ideal functionality paradigm together with the simulation paradigm make an extremely convenient framework for formalizing the most general security deﬁ- nitions of complex cryptographic tasks. Now that we have dealt with this central issue, let us turn to the challenge of designing protocols meeting these security deﬁnitions.

18.7 Secure Multi-Party Computation (SMC) After protocols for the many diverse cryptographic tasks were designed in succession in the late 1970s and early 1980s, Yao suggested that a single task may capture most of them. He formulated it for tasks with two players in [Yao82b], and described an ingenious protocol for it in [Yao86]. This result was soon extended to any number of players by Goldreich, Micali and Wigderson in [GMW87]. The task Yao proposed came to be known as “Secure Multiparty Computation” (SMC)303 deﬁned as follows.

• Secure multiparty computation: Some number of players wish to compute a public function f on their private inputs. An explicit description of the function as a Boolean circuit304

302In a certain sense, this is the best one can hope for. 303Sometimes also called and abbreviated diﬀerently in the literature, e.g. “Secure Function Evaluation” (SFE) and “Multi-Party Computation” (MPC). 304Recall that Boolean circuits are a universal model of computation, as discussed in Section 5.2. Thus any eﬃciently computable function can be encoded by a small circuit.

244 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

is known to all of them, but each of the input bits to the circuit is known to exactly one of them (a player can own many bits). The value of f on these inputs should become available to all, but nothing else. It is completely clear that most examples above fit this description (indeed the millionaire’s problem and the election were explicitly defined as function evaluations, GT and Majority respectively). Some others require a simple modification, e.g. collective coin flipping and other probabilistic functions can be modeled by allowing the circuit to have random inputs (which the players will have to generate together). Yet other tasks, like the Poker example and other “mental games” require a more substantial modification of SMC due to their interactive nature. One can also accommodate the natural extension that different players compute different functions of the same inputs (as is the case in the secret exchange problem). All of these extensions fall under SMC, but below for simplicity we will only refer to the deterministic, static, single-output definition above. The extremely general SMC problem, capturing almost any imaginable cryptographic task, has a secure protocol, where security is defined in using the general paradigms above. Namely, what the players experience is identical to sending all their inputs to a trusted party, who evaluates the circuit and sends them all back the correct answer. The single behavior possible in the real protocol but not in the ideal one is early abort (or failure) by some players, which may cause others never to see the output. This cannot be helped in 2-player protocols and one player aborts (or more generally, if half the players abort). But we will see that if a majority of the players follow the protocol we can achieve fairness, namely the guarantee output delivery to all players who did not abort. The intractability assumption underlying this general protocol is the most standard hardness assumption: the existence of trap-door functions (the same one used for the secure communication protocol, and is quite close to it in power305). Thus essentially if the most basic cryptographic task, namely secret communication, has a secure protocol, so does the very general SMC task (we shall return to this important point!). It gets even better: protocol design becomes completely automated, namely there is an efficient algorithm which, when given as input the circuit to be evaluated by the parties, outputs a description of the secure protocol, namely a specification of the algorithms of the participants. We state here an informal version of this completeness theorem. We distinguish (as is common and mentioned above) fair secure protocols (in which the delivery of the output to all participants is guaranteed), from just secure protocols (in which early termination of some players can cause other players never to learn the output value.) Theorem 18.1 [Yao86, GMW87] Assuming trap-door functions exist, • SMC has a secure protocol for any number of players n ≥ 2. • SMC has a fair secure protocol for any number of players n ≥ 3, provided a strict majority of the players follow the protocol. We now informally and at a very high level highlight some of the key ideas which go into the design of a protocol for this general problem. We stress that the full proofs are extremely involved and subtle. The original papers are missing many details; full details can be found in Chapter 7 of the second volume of Goldreich’s book [Gol04].

305The relationship between the trap-door function primitive, and the secure communication primitive, is actually quite complex. The advanced reader may want to consult [GKM+00, HO13] on the interrelationship of these and many other cryptographic primitives.

245 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

The proofs are divided into two conceptually separate parts. To explain them, let us discuss the way in which bad players can misbehave. In the security definitions above, we put no restrictions on the adversaries (besides efficiency as per Axiom 1); a simulator was required for every possible adversary (representing a participant or a subset of participants). Such adversarial behavior is called malicious in the literature, and it is these most general adversaries we want security against. A far more benign type of adversarial behavior is called semi-honest. Like honest players (the good guys), who follow the protocol specification verbatim, semi-honest do so as well, and the only fault each is allowed is simply to break down, namely stop all communication at some arbitrary point during the execution of the protocol (which may depend on the execution). Intuitively, such adversaries should be much easier to handle, but note that some of the problems above look impossible even when players are completely honest, e.g. the millionaires’ problem, or zero-knowledge proofs. The two parts of the proof show: 1. how to design an SMC protocol secure against (any number of) semi-honest adversaries, and 2. that every protocol secure against semi-honest adversaries can be enhanced to become secure against malicious adversaries, and can be made fair as long as they are the minority.

The beauty of both parts is that each uses the main tenets of computational complexity, namely completeness, reduction and locality of computation. Both parts use locality to identify a simple, complete component (which itself is a very special case of the same problem), design a protocol for this special case, and then use reduction (or composition) to extend it to the general case. Note that all this is possible partly because the SMC problem is general enough—it may be much harder to do reductions between protocols that only work for special cases of SMC, e.g. the millionaires’ problem. We now state more precisely the results of each of these two parts and sketch the ideas for proving each. A note on encryptions. Both parts rely on (different) encryptions of the players’ individual inputs which have special properties. We will not specify their nature or how to achieve them, and only note that both types can be easily constructed from standard trap-door functions. We will simply assume that they exist and explain how they are used. We start with part (2), which was already obtained a year before the SMC results in [GMW91]. Recall that this is the paper mentioned in the zero-knowledge Section 10.2. One major result of this paper is that every NP-statement has a zero-knowledge proof. In the same paper they apply this idea to simplify protocol design. Theorem 18.2 [GMW91] Every protocol secure against semi-honest adversaries can be enhanced to become secure against malicious adversaries, and be made fair as long as they are the minority. We reduce the theorem to a sequence of zero-knowledge proofs. Let us elaborate. How can we force a potentially malicious party, say Alice, to follow the protocol? Simply, by verifying that each message Alice sends is computed according to her (publicly known) specified algorithm. Well, that algorithm instructs that the message at hand should be a (publicly known) efficiently computable function, say g, applied to some publicly known data x (e.g. past messages in the execution of the protocol) and private data y known only to Alice, like her inputs and private randomness. Thus, Alice sends some message m, and the other players wish to verify that m = g(x, y), without Alice revealing y. Assume that every player publishes, at the beginning of the protocol, a commitment of its private data (e.g. an encryption of it using its own public key). Thus, all players have access to z = c(y), Alice’s commitment to her private data y (the commitment function c is public as well of course). But now the claim m = g(x, y) becomes an NP-statement! The NP-witness is simply y

246 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

itself (which includes Alice’s private randomness); having access to y (and the publicly available x), one can efficiently verify both that z = c(y) and that m = g(x, y). This means by [GMW91] that there is also a zero-knowledge proof of these equations, which Alice can now conduct as a prover, with the other players as verifiers! This of course needs much elaboration, which we will not give here, e.g. how other players are coordinated, how to avoid infinite recursion if some of them are malicious, etc. Note that in part (2) above “locality of computation” was simply the fact that a protocol execution is just a sequence of messages. We now move to part (1), where locality of computation will refer to the fact that every circuit evaluation is a sequence in the evaluations of Boolean gates. Theorem 18.3 [Yao86, GMW87] There exists an SMC protocol secure against (any number of) semi-honest adversaries, which is fair as long as a a majority of them do not fail before the end of the protocol. Yao’s proof for 2-party SMC reduces the design of a protocol for arbitrary circuits to the design of a protocol for a single gate306. The key insight was a definition of gate evaluation on hidden inputs in a way that composes to evaluating arbitrary circuits. And the idea is natural: simply ask for the output to be hidden as well. The main problem is that different inputs are owned by different participants and hidden from others. Thus, one needs to define “hidden” in a way that is consistent for all inputs and outputs of all gates. Then, if one gate can be so evaluated “in the dark” by the players, they can iterate the process and evaluate any circuit! Yao describes such an ingenious encryption scheme (which we will not explain), in which a gate can be evaluated by a single player. The second player just has to encrypt its inputs in this format, which is done using Rabin’s oblivious transfer protocol [Rab05, EGL85]. For the multi-party case, [GMW87] use a distributed encryption, in which the hidden values are shared amongst all players, who also carry on the gate-by-gate evaluation jointly. The joint construction of these distributed encryptions is performed via Shamir’s secret sharing scheme [Sha79b]. Indeed we need the verifiable variant of secret sharing due to [CGMA85] to protect against early abort. The gate-by-gate evaluations from these encrypted shares can now be performed by any majority of the players. Finally, in both protocols, there is also a way for (any majority of) the players to decrypt the final output of the circuit and make it available to all307. We conclude the SMC story by noting that the general theorems above are far from the last word. One important extension [CDD+99] was proving them secure for an adaptive adversary (one who observes the execution of the protocol and can corrupt different players according to it). Another important extension [Can01], through the paradigm of universal composability (UC) (which applies to protocol design beyond SMC), is proving them when the protocol is not executed in isolation, but rather concurrently with others, related or unrelated, involving the same players and possibly others.

18.8 Information theory vs. Complexity theory: Take 2 Most of this section hammered home the point that many tasks that are provably impossible in the information-theoretic setting (when no limitations are put on the computational power of players) can become possible in the complexity-theoretic setting (when they are so limited). Now

306It may be amusing to realize that this problem, say for the AND gate, is the very special case of the millionaires’ problem in which their fortune is restricted to 1 bit. This problem is still highly challenging, even if no one cheats! 307Again, in the case that half or more of the players abort, some others may not get the output (which is unavoidable, as e.g. for 2 players).

247 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

we stress the surprising lesson that one should rethink the seeming weakness of the information- theoretic setting in light of the power of complexity-theoretic protocols. The shining example is the secure multi-party computation (SMC). Recall the informal conclusion we drew from the fact that SMC can be based on trap-door functions: the ability to perform the basic task of secret communication entails the ability to perform the vastly general SMC. This idea can now be considered abstractly! Assume we have perfectly secure communication channels between every pair of participants. This assumption guarantees information theoretically, the basic task of secret communication by definition. What other tasks can be performed in this model with information- theoretic security? The answer turns out to be, like in the computational setting, practically all of them! Shortly after the computational papers on SMC, protocols for SMC were designed in this information-theoretic setting! This was done in two independent simultaneous works, using different techniques, one by Chaum, Crepeau and Damgard [CCD88] and the other by Ben-Or, Goldwasser and Wigderson [BOGW88] (see full details in [AL11]). Theorem 18.4 [CCD88,BOGW88] Assume private communication channels between every pair of players. There is a protocol for SMC that is secure against computationally unlimited adversaries as long as more than 2/3 of the players are honest. 1 Note that here we can only tolerate < 3 cheating players, whereas the computational setting 1 1 could tolerate < 2 . However, as in that setting, there is a natural sense in which the constant 3 is the best possible in this one. Of course, the security guarantee is far better, while the assumption may be reasonable in many concrete settings. Also, the protocols are simpler and significantly more efficient than in the computational setting. Finally, note that these protocols provide a completely different proof of the (fair) computational SMC results (and with the weaker constant), essentially by replacing the assumed secure private channels by computational encryption scheme308. In other words, had the information theoretic protocol been discovered earlier (it of course could have been), it would yield the computational result using only cryptographic secret communication. We find these connections between the two settings, information-theoretic and complexity-theoretic, important and fascinating. These connections are manifested in other ways and places309, and will surely play an important role in future developments.

18.9 More recent advances Until now we have talked about very old results which shaped the ﬁeld. However, cryptography is an extremely dynamic ﬁeld, constantly reshaped by changing demands from the real world, as well as the emergence of new ideas and techniques which resolve very old problems and challenges. In the next few bullets I discuss such exciting recent developments.

Homomorphic encryption Homomorphic encryption is a public-key encryption scheme that allows anyone in possession of the public key to perform operations on encrypted data without access to the decryption key. Initial public-key systems which allow this for either addition or multiplication (over appropriate rings), but not both, were known as soon as such systems emerged, in the late 1970s. The challenge to create a system in which both operations are simultaneously possible, called a Fully Homomorphic Encryption (FHE) scheme, was raised already then [RAD78].

308Of course, they give nothing for n = 2 players. 309Recall e.g. one beautiful example we have seen in Section 9.2 is the construction of information-theoretic extractors from complexity-theoretic pseudo-random number generators by Trevisan [Tre99].

248 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

It was also clear at the time what a powerful cryptographic primitive FHE would be, and more applications for it emerged over time. As one application, you could delegate computation on sensitive data to others, e.g. (this may be irrelevant for some readers), you can homomorphically encrypt your financial information, let your accountant do your taxes “in the dark”, and then decrypt. The importance of such ability became enormous with the advent of (computationally weak) mobile devices and (computationally powerful) cloud services, which routinely perform computations for them. FHE guarantees complete privacy of the inputs to these computations (and much more, as we shall see below when discussing delegation). As another application, Secure Multiparty Computation (SMC) discussed above, which captures numerous cryptographic tasks, could be achieved rather simply using FHE, and with a huge bonus. Namely, the known protocols, which are very communication intensive can be replaced (aside from pre- and post-processing) by a minimal communication protocol: the only communication needed is sending the encrypted inputs and outputs before and after the computation, respectively. Indeed, FHE looked just too good to be possible, but like other impossible-looking cryptographic tasks, it has yielded as well. It took 40 years for the seminal PhD thesis of Gentry [Gen09b,Gen09a]. Gentry’s ingenious initial construction was very complex and costly, and its security was based on a the hardness of a somewhat non-standard version of lattice problems. As expected, vigorous work ensued to simplify the construction, make it more efficient, and weaken the hardness assumption to a more standard one (as well as implement FHE in practice). One such recent advance is the paper [BV14], which provides considerable simplification, and relies on the more standard Learning With Errors (LWE) assumption of [Reg09,Pei09]. It is a challenge to rest FHE on general assumptions like the existence of trap-door functions.

Delegation of computation Let us elaborate on the “cloud computing” application above, which has numerous incarnations today. A weak computational device Alice (e.g. a mobile phone or a laptop) wishes to perform a computationally heavy task, beyond her computational means. She can delegate it to a much stronger (but still feasible) machine Bob (the cloud, or a supercomputer) who offers the service of doing so. The problem is that Alice does not trust Bob, who may give the wrong answer due to laziness, fault or malice. Can Bob convince Alice that the answer is correct much faster than it takes her to compute the answer herself? This is clearly a version of the interactive proof setting discussed in Section 10.1, but with two essential differences in the efficiency parameters, that are now “scaled down” to accommodate the application to delegation. The following doubly efficient interactive proofs requirements were formulated by Goldwasser, Kalai and Rothblum [GKR08]: we want efficient provers and highly efficient verifiers. More specifically, assume Alice wants to compute f(x) for an input x of length n where f is described by a known circuit of much larger (but still polynomial) size. The prover, Bob, should run in polynomial time310 (as opposed to having unlimited time in standard interactive proofs). The verifier, Alice, should only run in (nearly) linear time (as opposed to polynomial time in standard interactive proofs). Another feature of this setting which differs from the standard interactive proof model is that some protocols have very few rounds of interaction, often as low as only one round: one message from Alice to Bob, and one from Bob to Alice. After initial progress [GKR08, TKRR13] the problem was completely solved in the beautiful paper of Kalai, Rothblum and Raz [KRR14].

310Such interactive proofs are sometimes called arguments in the literature.

249 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Theorem 18.5 [KRR14] Assuming fully homomorphic encryption, there is a 1-round doubly eﬃ- cient interactive argument for every computation. One of the remarkable ingredients in this (cryptographic) result is a seemingly unrelated result in the standard (non-cryptographic) model of interactive proofs. Recall from Section 10.1 that in multiple-prover interactive proofs MIP a veriﬁer is allowed to interact with several provers, who are not allowed to communicate. This paper introduces a variant of this model, called no-signaling MIP311, and completely determines the languages it proves: the class EXP of problems solvable in deterministic exponential time. Compare this with Theorem 10.4, which for the original version proved MIP = NEXP. Going back to the original delegation question, note that there is another sense in which Alice may not trust Bob—she may want to protect the privacy of her input x from him, but still wants him to perform the computation for her. This is the model of Private Information Retrieval (PIR), introduced in [CKGS98]. The reader is encouraged to discover the exciting developments and remaining problems regarding PIR, which we will not discuss here. We also note that delegation Theorem 18.5 above need only assume PIR, as opposed to the (seemingly stronger) homomorphic encryption.

Program obfuscation Now here is a really strong cryptographic primitive, which every software company would love to have: a program obfuscator. An obfuscator O (which is allowed to be probabilistic) is an efficient algorithm that maps Boolean circuits to Boolean circuits, in a way that completely hides every aspect about them except their functionality. More precisely, if it maps a circuit C to a circuit O(C), then O(C) computes precisely the same function as C does, but reveals no more information about C than black-box input-output access to C would. For example, a company which designed a game or other piece of complex software based on their secret technology and know-how can release the obfuscated code without fear of their competitors. Program obfuscation is a fantastic kind of encryption that allows you to use a program code but not to understand how it works. Its existence would imply numerous other cryptographic primitives, including most discussed in this chapter. Unfortunately, program obfuscators cannot exist. This was discovered (with a highly complex proof) in the same paper by Barak et al. [BGI+01] that formally defined this notion. Given this sad news, they suggested an alternative definition, called indistinguishability obfuscators (or IO). An IO is also an efficient probabilistic map from circuits to circuits which preserves functionality (namely IO(C) computes the same function as C), which satisfies the following (indistinguishability) property. For every two functionally equivalent circuits of the same size C,C0, their obfsuscations IO(C),IO(C0) are computationally indistinguishable. Two things are unclear at this point. Can one construct IO (under reasonable intractability assumptions)? And what is it good for. These questions remained unanswered for over a decade, and then, starting with the breakthrough paper of Garg et al. [GGH+13] the subject came to life again. Indeed, the activity regarding this topic brings all the excitement of an excellent thriller, with ingenious constructions of IO based on new, unfamiliar hardness assumptions (mainly group theoretic and number theoretic), new algorithmic attacks refuting some of these assumptions (e.g. see [CGH+15,HJ16]), improved and repaired assumptions immune to past attacks, raging arguments about the reasonableness of surviving assumptions, and more. And this is only regarding the

311This no-signaling was ﬁrst studied in the context of quantum interactive proofs—it is a notion that comes from physics, motivated by the fact that information cannot travel faster than light.

250 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

first question, of the existence of IO. On the second question, of the utility of IO, there has been a flurry of activity as well, revealing its potential power. It was shown to imply a host of other, extremely useful cryptographic primitives, some of which have no previous constructions (e.g. see [SW14, GGHR14]). Further, IO was shown equivalent to the “best possible obfuscation” definition of [GR07], and more. It is extremely interesting how this subject looks when the dust settles!

18.10 Physical attacks This segment should sober down the uplifting feeling of the wonderful mathematical theory exposited above. As you all know, cryptographic systems abound. Are they secure? Well, we know they are mathematically secure, e.g. since no one has found an efficient factoring algorithm yet (to the best of my knowledge)312. So, how come we keep reading about hackers breaking into the most secure computer systems imaginable, like the Pentagon’s, and about electronic theft from bank and credit card accounts? The answer is of course, that these attacks work outside of the mathematical models above. The implementation of security systems offers numerous ways and loopholes that allow an attacker to invade a system without violating any of the mathematical, rigorous security proofs it rests on! Often, these weaknesses arise for intellectually boring reasons, like stupid and negligent actions of sending passwords or other identifying information in the clear, leaving the door open and the computer on, etc.313. However, research in the past decade or two reveals that even in seemingly watertight situations, minute weaknesses exist that allow ingenious attacks to completely break cryptographic systems. What might such minute weaknesses be? Computer systems are physical objects, and when they operate they emit a host of physical signals of various types. Furthermore, these signals are correlated with the operations they perform. In the words of the great cryptanalyst Adi Shamir, computers are telling us what they are doing, and we just have to listen. Taking this motto literally, Shamir and collaborators [GST14] have recently devised an acoustic attack in which a cheap micro- phone in the vicinity of a laptop performing RSA decryption can fully extract its secret RSA keys! This is but one example of a quickly developing field of side-channel attacks (or simply physical attacks) within cryptanalysis that sends waves of wake-up calls of different forms to designers of security systems to rethink their designs, in an endless game of cat and mouse. Such attacks include (I did not make these up—all phrases taken from actual papers) timing analysis, electromagnetic attacks, optical attacks, power analysis, bug analysis, microwave attacks, cache attacks, thermal analysis, cold boot attacks, and more. Some of these attacks apply to hardware as well! Many require, beyond ingenuity and insight, also sophisticated mathematical and physical analysis. Cu- riously, many attacks on cryptosystems are discovered in a way which may be likened to the way cures to diseases are discovered: one observes a system under a variety of conditions, until some strong signals appear314. Practically, for the time being, it seems that most of the physical attacks above cannot be performed on a large scale, namely applied simultaneously on a million computers, say. Mathemat-

312And the eﬃcient quantum factoring algorithm is still waiting for a quantum computer that can execute it - see more on quantum computing in Chapter 11. 313One popular jargon word for obtaining sensitive information this way is phishing - the reader can read about such attacks and protecting against them by searching for this word. 314For example, the paper above describes how viewing sonograms of a computer when performing a variety of diﬀerent arithmetic operations revealed patterns of frequencies which correlate with the binary representation of the secret RSA keys as these are processed during the execution of a decryption algorithm.

251 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

ically, the wealth of physical attacks above (many of which are only discovered experimentally), raise the challenge of theoretical abstraction and modeling that may inform the design of better security systems.

18.11 The complexity of factoring To add another bucket of cold water to the sobering news of the previous section, we go back to mathematical attacks. Many computer security systems today,315 supporting a vast electronic commerce and financial transaction network, rely on the assumed difficulty of factoring large integers. I believe that most people, and most decision makers, are not aware that a single, simple to state mathematical problem, which could potentially be solved by a math or CS undergrad tomorrow, is the only barrier to a potential economic meltdown. Indeed, it is hard to think of any other concrete potential mathematical discovery that can cause catastrophic damage of similar magnitude. Are we ready for this eventuality? Sure, we have (very) few alternative trap-door functions which can in principle replace factoring as the basis of these security systems, but these seem much less efficient, and would probably take months or years to implement. What would happen in the meantime? And if you find this doomsday contemplation too depressing, here is another question to mull over. Suppose that you find an efficient factoring algorithm—an amazing discovery that could bring you fame and fortune if published, but could also wreak havoc on electronic commerce—what would you do with it?

315Perhaps the majority still, even with the rise of elliptic curve cryptography, for which the questions we raise here can be studied as well.

252 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

19 Distributed computing: coping with asynchrony

Distributed computing captures any situation in which many computers or processes aim to achieve certain goals (common or separate), in a way that necessitates interaction. This of course includes server farms, super computers, sensor networks, organizational Intranet, and the Internet, but also your single laptop in which many components have some independence. Moreover, it can serve as a model for numerous phenomena in the natural sciences. Clearly, this is a vast and heterogeneous field. Distributed computing is similar to cryptography in many ways, like the interactions of many parties, the heterogeneity and multitudes of objectives, the complexity of formal modeling, etc., but the issues central to each are quite distinct. Indeed, there is plenty of interaction; cryptography is used in some distributed algorithms, and distributed algorithmic ideas are exploited in cryptographic protocols. In this chapter, we focus on one major issue which is present in distributed computing and absent from all other topics discussed in this book, namely asynchrony. Parties316 in asynchronous distributed computation cannot assume a common clock for keeping time and coordinating the global progress of computation among them. The information one expects from another party may be indefinitely delayed, so there is no way to find out if such a party is simply slow, completely broken, or maliciously refusing to cooperate at this point. Even when all messages from other parties eventually arrive, their order of arrival may be arbitrary. But life must go on, and each party must keep making decisions according to its local view and continue the computation. Note that asynchrony is a real headache: it can arise from computational differences between the parties, properties of the underlying communication media between them or other reasons, and hence must be dealt with. Indeed, this issue is so central that even the subfield of asynchronous distributed systems is very large. Some excellent texts on this subject include [Lyn96,AW04], which in particular make formal the high-level language below. We will discuss two of the most basic problems that asynchronous systems need to solve, one in which the parties have a common goal, and one in which they have conflicting goals: coordination and sharing resources or, in the picturesque language of the field, the Byzantine generals problem and the dining philosophers’ problem. We will see that in very general settings these two prob- lems317 are actually completely impossible. Here, unlike most of the book where we focus on easy vs. hard, impossible really means impossible, as in Turing’s result for the Halting problem. Namely, there are no finite algorithms for these problems! As with Turing’s work, impossibility results are extremely useful—important problems really need to be solved, and impossibility results focus on the need to add assumptions or weaken the requirements, as befits a variety of practical settings. In distributed computing impossibility proofs are very delicate, and the precise definition of what asynchrony means and what the communication medium allows are extremely important—we will explain some of the principles underlying these modeling issues. We will also see how an a-priori quite unexpected mathematical field—algebraic topology—seems to be intimately connected to such distributed problems in asynchronous environments, and very powerful in proving both impossibility and possibility results. Finally, the impossibility results we discuss will be for deterministic programs. As we saw in other chapters, randomness is extremely powerful here as well: in the

316 It must be a coincidence that parties, processors, players, participants, philosophers, Pi, etc. all start with the letter “p”. We shall use them interchangeably in this section when referring to the interacting entities in distributed systems. 317Hundreds of other impossibility results, as the title of these papers proclaim, can be found in [Lyn89, FR03].

253 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

asynchronous setting it can make the impossible possible!

19.1 High-level modeling issues Here we informally discuss some major issues that must be formally deﬁned for asynchronous distributed computing. The problems and results we discuss later in the chapter will make some of them more concrete. This subsection is mainly to impress the reader with the complexity of modeling in this ﬁeld. Again, the textbooks cited above and the references provided give far more precise and detailed information.

Atomicity In the absence of a global time that all players can reference, simultaneous actions can destroy information (or worse, your assets and even your life in some applications of concurrent algorithms). This is resolved by introducing atomic actions. I know, it sounds even worse for humanity, but you know what I mean by atomic here; happening instantaneously, without interference. More precisely, certain access primitives of processors to objects (like reading from or writing into a memory register, testing for the availability of a resource, seizing control of an available resource, etc.), which in reality are never instantaneous, are treated as if they were instantaneous: access of an object by one processor must be completed before another can access it. The choice of access primitives naturally varies depending on the application, and their physical realizability and cost (in hardware or software). The study of their relative power is an important part of this theory (and occupies voluminous literature). We will specify the choices made for the problems we discuss, but just to impress you with the variety, here are the names of some of the atomic read-modify-write primitives invented and studied for accessing a memory register: test-and-set, fetch-and-add, compare-and-swap and load-and-store.

Program Concurrent programs (or distributed protocols) assign a program to each participant, whose steps alternate between local computation and some atomic action to shared variables. There is typically no limitation on a processor’s computational power or memory or communication318. In some but not all problems, an input is given to the participant before the computation starts.

Symmetry A collection of important problems studied are symmetric problems, in which the speciﬁcation of correct behavior or legal output is the same for all players (who are considered identical, e.g. have no unique IDs). For such problems, it is desirable to have the individual programs used by each player be identical (such concurrent programs are sometimes called anonymous). We will require it here as well, as the problems we consider are symmetric in this sense.

We now discuss the execution (or run) of concurrent programs in an asynchronous environment.

Asynchrony Given atomicity of action, let us articulate the meaning of asynchrony. We (and the general theory) usually take the worst-case scenario: a (scheduling) adversary controls the execution of a concurrent program. It “wakes up” the diﬀerent parties at will. It is allowed to schedule and interleave atomic actions in an arbitrary way, with full knowledge of the global system state so far. The only limitation on this adversary is that it must keep each processor’s own actions according

318This is especially convenient for our focus on impossibility proofs, as it makes them stronger. In actual algorithms one of course cares about minimizing all of these, see e.g. [EGSZ16].

254 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

to the order they were performed; this guarantees that every local view is consistent. However, it is entirely possible for example that two successive messages sent from A to B will arrive in the reverse order.

Faults An important aspect of the theory are the faults that a computation must be able to tolerate. As in cryptography, the theory generally distinguishes two major kinds of faults. The benign kind is simple termination (sometimes called “fail-stop” or “crash” fault) of a processor at some point during computation. This can be modeled by having the scheduling adversary indeﬁnitely delay all the future actions of that processor. The malicious kind (typically called Byzantine) allows a processor to act arbitrarily, completely ignoring the program it should execute. We will focus here on the ﬁrst kind, again making the impossibility results stronger.

Communication medium There are quite a few communication models studied in distributed systems. The most common are message passing and shared memory, each comprising many variants and submodels. In the first the players are vertices in an undirected graph, and they can only communicate by exchanging messages with their direct neighbors (see e.g. [AW04] for formal definitions and background). In the second, there is a set of shared registers supporting some kind of atomic actions. Often shared resources provide such means of communication—they are either “locked” (when in use), or “free” (when not), and this status can be accessed and provides external information to processors. The variant we will use when discussing consensus allows each shared register to be read by all, even simultaneously (as in a broadcast setting), but each can be written to by only one specified player. The shared-memory model often provides a more global view to the participants than the message-passing model319. For example, there is no way in the shared-memory model for one party to send different messages to others; everything she writes can be seen by all others. Indeed, it is easy to simulate message-passing algorithms in the shared-memory model (using read-write registers). It is thus easier to design concurrent algorithms for, and harder to prove impossibility results for the shared-memory model. However the paper [ABND+87]320 gives a simulation in the other direction (namely, of read-write registers in the message passing system), provided that a majority of the participants do not crash (or alternatively if less than a third are Byzantine).

Properties of programs Given the complexities that concurrent programs have to endure, especially the power of the scheduling adversary, it is nontrivial to specify what “successful” program is. Of course, this depends on the problem it is supposed to solve or the behavior it should induce. We mention, in rough terms, a few of the many properties studied; we will see some in action soon. More precise information on these properties and their relations can be found in [HS11]. Essentially, all require the continued functioning (in various senses) of a system despite arbitrary delays and possible failures of some of its components. In a wait-free program every processor which remains alive (does not fail) must compute its output after a ﬁnite number of steps. In a deadlock-free program, unless all processors halted, some processor will gain access to a requested resource. In a starvation-free program, every processor which requests some access eventually gets it. In a fair program, every access granted to one processor will be eventually granted to another who requests

319This is of course a generality; each of these models has numerous submodels and the relationship is more tricky; a comprehensive paper on these relationships is [AFR06]. 320Written after most results described below.

255 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

it. Note that some properties are ordered, e.g. fairness implies in particular no starvation, which in turn implies no deadlock. It is worth stressing that a property is satisﬁed by a concurrent program if it is satisﬁed in every possible execution of that algorithm (for all possible scheduling of actions and allowed failures).

19.2 Sharing resources and the dining philosophers problem Edsger Dijkstra, who laid the foundations of distributed computing and concurrent programming321 (as well as other areas of computer science) liked to invent stories which capture the many issues arising in the ﬁeld. The dining philosophers’ problem is among the most famous ones, and has served as a model problem for concurrency control problems ever since. Dijkstra described it in [Dij71], and Hoare formalized it in [Hoa78]. This problem abstracts the diﬃculties of resource allocation in symmetric environments. We repeat Dijkstra’s informal version, which of course requires translation to the dry language of processors and resources. It is depicted in Figure 20. Imagine n philosophers sitting around a table. The philosophers are identical, namely have no unique names of IDs. Between every two philosophers is a fork. In front of every philosopher is a bowl of (an unlimited amount of) pasta. Bowls are private but forks are shared. Philosophers

Figure 20: Dining philosophers’ table alternate between two activities: thinking and eating. To think, no (external) resource is needed. To eat, a philosopher must use both forks, the one on her left and the one on her right. An atomic action is requesting an adjacent fork, and, if available, taking it322. A philosopher who obtains both forks eats for a while and then releases the forks one after the other. The original challenge calls for a deadlock-free program (in which at least one hungry philosopher gets to eat). We will also discuss a starvation-free program (in which all hungry philosophers get to eat). As the situation is symmetric, we demand that the concurrent algorithm be symmetric as well, namely every philosopher has the exact same program. This requirement implies also

321His paper [Dij65] on mutual exclusion marks perhaps the birth of the ﬁeld. 322So, access to a fork is mutually exclusive.

256 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

complete symmetry of the philosophers themselves; they are identical, and in particular have no unique names or IDs. A simple program P which illustrates the problem is the following. 1. Try to obtain the left fork. 2. Try to obtain the right fork. 3. If unsuccessful in either go to 1. 4. Eat. 5. Release left fork. 6. Release right fork. It is clear that this program P is not deadlock-free. Imagine a scheduler which activates each philosopher for just one step (in any order). After this, each is holding her left fork, and this state will never change, regardless of the future activation order. Of course, one can avoid deadlock: simply consider the program which attempts lifting the left fork and then releasing it. The problem of course is that no one ever gets to eat. Can you find a starvation-free program? There were many suggested programs, but all went outside the model above and either broke symmetry (e.g. by giving the philosophers different IDs), changed the problem (e.g. by making the philosophers “hygienic” [CM84], by adding a “waiter”, etc). But Dijkstra’s original problem remained open, until Lehman and Rabin [LR81] proved that solving it is impossible. Theorem 19.1 [LR81] There is no deadlock-free deterministic, symmetric program for the dining philosophers problem. A proof must present, for every such program a scheduler that causes all philosophers to starve. The idea of the proof is simple (though formalizing it is not). The scheduler simply activates each philosopher for one step in a cyclical order, and repeats these rounds forever. The inductive claim, on the number of such rounds, is that before each round begins, the state of the system is symmetric (i.e. all philosophers are in the same state). This is true at the start, and the symmetry of the program ensures that, in each round, the result of the (inductively the same) step of any philosopher is the same. To conclude, assume that in some round some philosopher is eating. The inductive claim, and the fact that each philosopher executes exactly the same step with the same result per round, imply that, at the end of this round, all philosophers are eating. But this is impossible, as each needs two forks to eat! Observe that asynchrony is crucial to this impossibility result, but that is used here in a rather benign way. The scheduler essentially prevents any player from executing two successive steps of its program before other players each executing one step in between. But the main message of the paper [LR81] is that there is a solution if one allows probabilistic programs! They show that a natural probabilistic variation of the program P above will foil the scheduling adversary, and some philosopher will get to eat with probability 1! Indeed, in the new probabilistic program R (which they call the “free philosophers algorithm”), essentially the only change is that when a philosopher who holds no forks tries getting one, he tosses a fair coin to decide whether to first try the left or the right fork. The correctness proof is quite nontrivial. It makes crucial use of a (natural) assumption, that every non-faulty philosopher must be activated infinitely often by the scheduler. This assumption was removed by Duflot, Fribourg and Picaronny [DFP04] (who also develop a very elegant formal framework to express the analysis of such probabilistic programs).

257 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Theorem 19.2 [LR81, DFP04] There is a probabilistic symmetric program for the dining philosophers problem that is deadlock-free with probability 1. We conclude with another gem from [LR81]. They observe that, for program R, there are schedules which will prevent all but one of the philosophers from eating! While deadlock-free, this program is far from satisfactory (at least for hungry philosophers). They devise a new probabilistic program R0 which fixes this problem, and is starvation-free! A key ingredient is allowing the state of a fork to tell us more than just whether it is in use or not. Recall that there was no restriction in letting a state carry more information, as long as it is finite and local. The new algorithm only adds just one bit more to the state of a fork: which of the two philosophers adjacent to it ate last. (The initial state can be arbitrary.) Then program R0, which they call the “courteous philosophers’ algorithm”, simply prevents the last eater adjacent to a fork from trying to access it. This modification guarantees that, in every schedule, every philosopher which is activated infinitely often, will also get to eat infinitely often with probability 1! Theorem 19.3 [LR81] There is a probabilistic symmetric program for the dining philosophers problem, which is starvation-free with probability 1.

19.3 Coordination: consensus and Byzantine generals In the previous section, the problem we studied reflected a conflicting situation between participants, where they competed for shared resources, and the main problem was symmetry breaking. We now switch to a problem reflecting a cooperative situation, where players are jointly trying to compute a function (or perform a more general task) that depends on their private inputs, and where asynchrony is the main hurdle. We will consider it in both the shared-memory model and the message-passing model described earlier. A common formal model for describing concurrent programs for such collaborative tasks, in both types of communication media, is the Input-Output Automaton (IOA) of Lynch and Tuttle [LT89] (but naturally we will keep the discussion informal). The property of programs we will focus on, called wait-freedom in the shared-memory model (and sometimes simply fault-tolerance in the message passing one), is that every “good” participant completes the task correctly in finite time, regardless of how all other participants behave. Here “good” simply means “live” in the fail-stop fault model, and “honest” for malicious (or Byzantine) fault model. The problem we will focus on is the consensus (or agreement) problem. It came up very early on for numerous practical applications, in which occasional failure of components is possible. Amongst the most commonly mentioned applications are transaction control (e.g. two computers have to commit to when a transfer of funds from one bank to another was performed), consistency control (e.g. recovering from a crash, how a computer updates its memory from others that keep copies of the same information), flight control (e.g. air traffic control and the waiting airplanes must agree who gets permission to land), and coordination (e.g. a set of army generals has to agree if their units should attack or retreat323). Clearly, in all these (and other) examples, consensus is a kind of synchronization primitive which is absent (but needed) in the system. More globally, considering the asynchronous, faulty environment the participants are in, it becomes evident that a consensus primitive would be extremely useful to have. For example, if they agree on a leader, then that leader could be the keeper of time and, hence, of the progress of

323The name Byzantine generals problem, coined by [LSP82] is a common synonym for the consensus problem with potentially malicious faults.

258 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

computation, can possibly collect all other inputs and perform the computation himself, etc. Indeed, consensus feels like a natural “complete” problem. Of course, it is not that simple, as such a leader can fail, or worse—be malicious. But while not simple, it is true—the consensus task is complete, at least in the shared-memory model! A foundational paper of Herlihy [Her91]324 which sets up the structural theory of wait-free programs, studies the relative power of shared memory objects, formally deﬁnes reductions between them, and proves completeness of consensus for such tasks. Summarizing, for intuitive, practical and theoretical reasons, consensus is a basic problem—let us now deﬁne it and ponder its solvability.

The consensus problem In words, consensus means that the players must all agree on one value, held initially by at least one of them. Let us state it a bit more formally, for the simplest case of binary values. Of course, some applications require large value domains, but our main concern here will be impossibility results. Imagine n processors P1,P2,...,Pn. Player Pi has a binary input value xi ∈ {0, 1}. Its task is to commit to a binary output value yi such that the following properties are satisﬁed:

• Consistency All committed values yi are equal.

• Validity Every committed values yi must be equal to some xj. Again, the challenge is to find a concurrent program in which every processor commits (or dies) in finite time. Note that the validity constraint prevents a trivial (and useless) solution in which they all commit to 0 regardless of their inputs. The breakthrough paper of Fischer, Lynch and Paterson [FLP85] showed that consensus is impossible in the message-passing model in the strongest imaginable sense. Theorem 19.4 [FLP85] For every n ≥ 2, there is no program for consensus in the message passing model which tolerates even one, fail-stop fault325 326. Moreover, the proof goes through even if all messages sent are guaranteed to be delivered in finite time, and even if we require that only one live processor commits in finite time! Furthermore, despite the symmetry of the problem, the result holds for any program, not necessarily just symmetric programs (e.g. it does not help if each processor knows and uses its unique ID). We recommend reading the clear detailed proof in the original paper [FLP85]. Here we highlight some high-level elements of the proof, as we will return to it later. The proof has two conceptual parts. First, it uses a hypothetical finite program to classify all configurations of the system reachable when running it. Then, it uses this classification to prove the existence of an infinite execution. Let us elaborate on these two parts. To start, assume for contradiction that a given program has the property that on every execu- tion327 some processor commits to a binary value in finite time. Take the first time that happens, and note that due to consistency no other value be later committed to by any other processor. This first value committed in each execution is now used to classify all global configurations (namely,

324Playing a similar role for distributed shared-memory wait-free algorithms as the Cook-Karp-Levin papers for sequential polynomial-time algorithms and veriﬁcation. 325Prior to this [LSP82] proved impossibility for 3 players and one malicious failure. 326An informal argument for impossibility in the special case n = 2 players was given in (the appendix of) [AEH75]. It is a good challenge to write down a formal proof for this simple case, if only to realize the need for precise deﬁnitions of what the processors and the scheduling adversary can do. 327Recall that each ordering of processor actions and messages delivered yields an execution, or run of the program.

259 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

the states of all processors and all message queues) that the program may arrive at as univalent or bivalent. We call a configuration univalent if all continuations yield the same committed value. We call it bivalent if some executions lead to a commitment of 0, and others to a commitment of 1. Clearly, no bivalent configuration is the final one. This classification sets up the following inductive argument for finding an infinite run. The (simple) base case is proving that there exists an input for which the configuration is bivalent. The (sophisticated) inductive argument shows that from every bivalent configuration, there is a finite schedule which leads to another bivalent configuration. This combinatorial argument, which carefully uses the properties of the model, is the heart of the proof. It now follows by induction that for some schedule the program runs forever, proving that there is no wait-free program. The notion of bivalent, and more generally, indecisive configurations (e.g. for non-binary inputs) was extremely influential for future impossibility results. Indeed, the theorem above was extended to show impossibility of consensus also in the shared-memory model, by Loui and Abu-amara [LAA87] and by Herlihy [Her91]. Theorem 19.5 [LAA87, Her91] For every n ≥ 2, there is no wait-free algorithm for consensus in the shared-memory model which tolerates even one fail-stop fault.

Probabilistic programs Of course, these results justify a variety of extra assumptions or relaxations of the problem used in practice, which actually lead to possible finite programs for this essential task of consensus. But like the case of the dining philosophers, the original problem is solvable if randomization is allowed328! Moreover, this positive result holds even under malicious faults. The first probabilistic algorithm, for the message-passing model329, was discovered by Ben- or [BO83]330. It has two parts, depending on the type of fault; it can handle less than n/2 fail-stop faults, as well as less than n/5 Byzantine faults (the latter bound was improved by Bracha [Bra84] to n/3). Theorem 19.6 [BO83, Bra84] For every n, there is a probabilistic concurrent program for the consensus problem which terminates in finite expected time under any of the following assumptions:

• Less than n/2 of the players may fail. • Less than n/3 of the players are malicious. A key to Ben-or’s and all subsequent algorithms for this problem is a certain reduction of consensus to a joint coin-ﬂipping problem. These original solutions, while ﬁnite, ran in expected exponential time, and the race was now on to improving their complexity. Most of this development, leading to some expected polynomial-time algorithms, is given in historical and technical detail in Aspnes’ survey [Asp03]. But a central challenge remained open since Ben-or’s original paper. His algorithm tolerates a “strong” adversary, namely one who chooses which players to corrupt during (and depending on) the execution. As mentioned, the algorithm requires expected exponential√ time for a constant fraction of malicious faults, but if the number of bad guys drops below n then the complexity improves to expected polynomial time. The remaining challenge was the possibility of

328And wait-freedom is now deﬁned as termination in ﬁnite expected time 329And hence also for the shared-memory model which can simulate it. 330The title of this paper refers the Lehman-Rabin paper [LR81]. This is not surprising as Ben-or was Rabin’s Ph.D. student at the time.

260 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

an expected polynomial time program that can tolerate a constant fraction of malicious faults. This was ﬁnally resolved recently, 30 years later, by King and Saia [KS13] in the aﬃrmative! Theorem 19.7 [KS13] For every n, there is a probabilistic concurrent program for the consensus problem which terminates in expected polynomial time even if a (strong) adversary can corrupt up to n/500 players during the execution331.

19.4 Renaming, k-set agreement and beyond We now return to deterministic programs, and the birth of the wonderful connection between topology and asynchronous distributed computing. Unless otherwise mentioned, all results stated are in the shared-memory model, which most subsequent work focused on. The impossibility of consensus, and attempts to understand the limits of the proof of Theo- rem 19.4, pushed researchers to define related problems to understand the boundary between the possibility and impossibility of basic agreement tasks in asynchronous environments. One possible clue was the numeric coincidence: consensus requires one common output value, and this is impossible already with even one fault. The paper [ABND+87] studied some general renaming problems extending consensus, in which the set of possible output values must be smaller than the set of possible input values. In computer systems, shrinking the name space is a very common problem when many computational threads attempt to use a few common resources. The paper [ABND+87] gave some possibility and impossibility results which depended on the gap between the sizes of the two sets, and on the number of faults allowed. However, an exact characterization of the boundary remained open. To obtain a tight understanding after the paper above, Chaudhuri [Cha93] defined a specific renaming problem, the k-set agreement problem, as follows. Again we have n players, P1,P2,...,Pn. Player Pi has an input value xi from a set of size k + 1, say xi ∈ {0, 1, . . . , k}. Its task is to commit to an output value yi such that the following properties are satisfied:

• Consistency The set of committed yi has cardinality at most k.

• Validity Every committed yi must equal some xj. Again, the challenge is to find a concurrent program in which every processor commits (or dies) in a finite number of steps. Note that the consensus problem is the special case of k-set agreement with k = 1. Also note that the validity constraint remained the same. The first (positive) result obtained by Chaudhuri [Cha93], extends the obvious fact that consensus is possible with 0 faults, and hinting again at the same numeric coincidence. Theorem 19.8 [Cha93] For every n and k, there is a wait-free protocol for k-set agreement tolerating less than k faults. To extend [FLP85] and prove impossibility when the number of faults is exactly k, Chaud- huri [Cha93] tried to imitate and generalize its proof technique to this case. She defined the natural analog of bivalent configurations, here indecisive (or (k +1)-valent) configurations, which cannot be final (as there are still continued executions which can lead to all possible different commit values for the first committing players). It remained to give the analogous inductive proof that such indecisive configurations can be forced by a nasty schedule to persist forever. The paper proved only the

331Clearly no attempt was made to optimize the constant—the proof is complex enough without it.

261 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

base case of the induction, namely that there exists an input which makes the initial configuration indecisive! Recall that this was very easy for k = 1. For k > 1 it is not, and a key contribution of this paper is the argument for proving the base case: using a tool we shall soon discuss called Sperner’s lemma! The paper further expresses the hope that a similar argument can prove the inductive step, completing an impossibility proof. The “Sperner lemma” hint was enough for three independent teams to quickly fulfill this hope. Borowasky and Gafni [BG93], Saks and Zaharoglou [SZ00], and Herlihy and Shavit [HS99] proved the impossibility of k-set agreement (even with k faults). Theorem 19.9 [BG93, SZ00, HS99] For every n and k, there is no wait-free program for k-set agreement tolerating k faults. The proofs in the papers [SZ00, HS99] explicitly use topology. This connection has opened the door to the uses of a powerful mathematical theory for understanding asynchrony in distributed systems. In particular, it has the extremely appealing aspect of representing dynamic objects like programs, schedules and executions as geometric or topological objects in a way that allows reasoning about the structure of static objects to reflect on properties of the dynamic ones! An excellent book describing these developments is [HKR13]. The theorem above was proved for the shared-memory model, and so, as discussed, also holds for the message-passing model. We note, however, that for that weaker model, a simpler impossibility proof was later discovered [BRS11] which is devoid of topology altogether; indeed they find a reduction in this model from consensus to k-set agreement, which allows them to directly apply the message-passing impossibility result Theorem 19.4. Let us return now to the shared memory model for the rest of the section. The three papers above proving Theorem 19.9 use topology in various degrees of explicitness332. While [BG93,SZ00] prove only the theorem above, the one in [HS99] derives this theorem from a much more general one we that will mention at the end, which uses algebraic homology theory. But first, let’s us give a very high level description of the proof—from the height chosen, they all look alike. However, I am mostly following the structure of the proof in [SZ00], and the mountain of details I am hiding under the rug here can be found in their paper, which also provides plenty of intuition and carefully explained special cases.

Sperner’s lemma and Brouwer’s fixed-point theorem To begin with, let us state Sperner’s lemma, which is a combinatorial statement. Then we will state the Brouwer fixed point theorem, which is a topological statement. And then we’ll describe a reduction, showing how the second follows from the first. This will set up the stage for the proof above. The impossibility theorem for k-set agreement, which is a computational statement, reduces in essentially333 the same way to Sperner’s lemma as the Brouwer fixed point theorem does! Indeed, the impossibility theorem may be viewed as a fixed-point theorem. We will restrict our attention to k-set agreement for k = 2, which means we’ll need Sperner and Brouwer only for the Euclidean plane R2, which is easy to illustrate on paper. The same ideas carry over quite simply for general k, using the appropriate terminology of these mathematical results in Rk, which we will avoid (e.g. replacing triangles by simplices, triangulations with simplicial subdivisions, etc.). We note that the reader might want to imitate the proof below for the 1-dimensional case k = 1 (in which there are only line segments). Here

332A later proof of Attiya and Casba [AC11] is completely combinatorial, but clearly states the value of the topological viewpoint leading to their proof. 333A lot of hard work is hidden underneath this word.

262 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Sperner’s lemma and Brouwer’s fixed-point theorems are really easy, but as noted the consensus (k = 1) impossibility result is not. We return to R2. We will need a few basic definitions. Please consult the pictures below. Let T be a (geometric) triangle in the plane with vertices v1, v2, v3.A triangulation D of T is simply a partition of T into a finite number of (smaller) triangles. The vertices of D, denoted V (D), are all the vertices of these smaller triangles. A 3-coloring χ : V (D) → {1, 2, 3} of the vertices of D is called Sperner if it colors the vertices of T with distinct colors, namely χ(vi) = i, and colors every vertex u on the interval [vi, vj] with one of its endpoint colors, namely χ(u) ∈ {i, j}. Finally, a triangle in D is called a rainbow triangle its vertices have distinct colors.

Figure 21: Triangulation and Sperner coloring. Rainbow triangles are shaded. (Source: Wikipedia)

Clearly, if D is the empty triangulation (namely it leaves T alone), then there is only one Sperner coloring, and it makes T a rainbow triangle. Once D is nontrivial (namely vertices are added), T stops being a triangle in D, and there are several Sperner colorings. However, any way you do it, you cannot avoid a rainbow triangle. This is Sperner’s lemma. Theorem 19.10 [Spe28] For every triangulation D of T , and for every Sperner 3-coloring χ of V (D), there is a rainbow triangle in D. The proof of this lemma is simple, essentially following from the fact that every undirected graph has an even number of odd degree vertices (and if you’ve never seen it, please try proving it). We now state Brouwer’s fixed-point theorem, showing that another object is unavoidable: a fixed-point in any continuous map from T to itself334. Theorem 19.11 [Had10, Bro11] For every continuous function f : T → T there must be a point x ∈ T such that f(x) = x. We now derive this theorem from Sperner’s lemma. Fix a continuous map f : T → T . The reduction has 3 parts: First, obtain from f a 3-coloring χf of all points in T . Second, show that for every triangulation D, χf is a Sperner 3-coloring of V (D). Third, apply this argument for finer and finer triangulations, and show that, in the limit, a rainbow triangle under χf is a fixed point of f. Let us first see how f induces a 3-coloring on all points in T .

334Why is this a topological statement? Simply because the same statement holds for any subset of the plane that can be continuously deformed to a triangle. To see his, compose the deformation with the given function, ﬁnd a ﬁxed point and invert the deformation.

263 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

1. χf is deﬁned as follows. Let w be any point in T . Then, w = λ1v1 + λ2v2 + λ3v3 with λ1 +λ2 +λ3 = 1. Similarly, since f(w) ∈ T , f(w) = µ1v1 +µ2v2 +µ3v3 with µ1 +µ2 +µ3 = 1. Let χf (w) = i for the smallest i ∈ {1, 2, 3} such that λi ≥ µi > 0. Note that such an i always exist.

2. Observe that every i satisﬁes χf (vi) = i and that every u ∈ [vi, vj] satisﬁes χf (u) = min{i, j}. Thus, in particular, for every triangulation, this coloring is Sperner.

3. Assume {Dm} is a an infinite sequence of triangulations, where D0 = T , and Dm+1 a refinement of Dm such that every triangle of Dm is partitioned into triangles of area at most 1/2 of 335 the original area . Clearly, T = T0 is a rainbow triangle in D0. By Sperner’s lemma, if Tm is a rainbow triangle in Dm, there must be some rainbow triangle Tm+1 in Dm+1. So, there is an infinite sequence of nested rainbow triangles. Let x be their intersection. By the definition of χ, x, and the rainbow property, if x = α1v1 + α2v2 + α3v3 and f(x) = β1v1 + β2v2 + β3v3, we must have αi ≥ βi for all i. But then f(x) = x.

Proof sketch of the impossibility theorem With this proof in mind, we finally get to the impossibility theorem. Let us first recall the proof sketch of the impossibility Theorem 19.4 for consensus (and its adaptation to the shared-memory model Theorem 19.5, which is similar), and see how we can extend it to 2-set agreement. Given a hypothetically wait-free program π, the proof inductively generated an infinite sequence of indecisive configurations Cm of the system. First, it proved that some initial configuration C0 is indecisive (recall that this was done already for every k by Chaudhuri [Cha93].). Then, it proved that, if any configuration Cm is indecisive, there is a finite schedule which leads from Cm to another indecisive configuration, Cm+1. This is the hard part for k > 1 (which worked for k = 1). With plenty of hindsight, notice the syntactic similarity of the infinite sequence of indecisive configurations {Cm}, which are generated by a single schedule in that impossibility proof, and the infinite sequence of rainbow triangles Tm, which are nested in the reduction of the fixed-point theorem to Sperner’s lemma. Ah, if we could only add the right semantics to this syntactic analogy. . . Let us try, now more carefully following [SZ00] (but more wildly oversimplifying, keeping the bare bones of its intuition). Again, we do it here for k = 2. And as suggested above, the reader may want to imitate our argument for k = 2 below with an argument for the simpler k = 1 (consensus) case, which may be revealing for some of the definitions336. A key idea is to ignore the configurations for a while (whose description depends on the program we don’t have), and focus on the schedules. There is really no loss in doing so, as fixing an initial configuration C0 and a schedule (say, s), the program π determines the sequence of configurations it generates in the execution. Schedules are independent of the program, and their structure is simple. In the shared-memory model, they may be viewed as infinite sequences in S = Σ∗, where the alphabet Σ is all non-empty subsets of the players (namely, the subset of players which are allowed by the scheduler to write to memory in this step337). S is a compact set and we can imagine mapping it to the triangle T by a continuous map338.

335 The refinement and area condition on the sequence Dm are not necessary for this reduction—we do it to facilitate the next one. 336Both papers [SZ00, HS99] give a detailed account of the case k = 1 before starting the proof for k > 1. 337Reads also have to be incorporated, but we ignore this here. 338We ignore here a crucial point which is elaborated in [SZ00], that does not affect our level of description. Namely, that one actually needs to define equivalence classes of schedules in Σ∗ to define S, and this gives a different topology than the simple product topology on Σ∗. Roughly speaking, two schedules are equivalent if they induce the same sequence of contents of all shared registers.

264 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

The question is how to do that? The next key idea is that, in the reduction above, the sequence of nested triangulations was arbitrary, so let us pick it conveniently to accommodate such a map. Make 339 each refinement look as in the figure below , which may be viewed as the first triangulation, D1. In it, every region is labeled by a non-empty subset of the three340 players. Now imagine recursively triangulating every triangle in the same way (with a consistent labeling we will not describe, but which is natural). This yields the infinite sequence {Dm}.

{1}

{1,2} {1,3} {1,2,3}

{2} {3} {2,3}

Figure 22: Basic “triangulation”, i.e. D1.

The nested sequence Dm now supplies us with a natural canonical map µ of sequences S to T . If s = σ1, σ2,... is a sequence in S, it defines a sequence of triangles t1, t2,... , with tm ∈ Dm in a natural way—if you are in tm, then σm+1 is the label of the next region tm+1 inside tm. Let µ(s) ∈ T be defined as the intersection of all tm. Now observe some important properties of this map µ. 1. The map µ is onto, so we have labeled the points of T by the elements of S. 2. While the map µ is not a bijection, we will assume for simplicity that it is, namely that µ−1 is well defined.

3. The map µ is continuous, under the natural metric on S: if two sequences s, s0 agree on a preﬁx of length `, then the distance between µ(s) and µ(s0) is at most |Σ|−`.

m 4. The map µ assigns a face (a vertex, edge or triangle) in Dm to every ﬁnite schedule s ∈ Σ . There is a continuation in s in each triangle touching this face.

Now it is time to 3-color our triangulations, and finally apply Sperner’s lemma to conclude the proof. Indeed, we will define a 3-coloring χπ of all points in T , using the program π which we assume is wait-free. Take any u ∈ T , and let s = µ−1(u) be the schedule mapped to u (which we assumed is well defined). By assumption, some player commits to a value under π on s in finite time; let this value be χπ(u). This defines χπ on all of T , and in particular on all vertices of all

339Please imagine that the three pentagons in the “triangulation” are triangles too. It is another detail swept under the rug, which is better for the intuition. A simple ﬁx is triangulating each pentagon by chords from the appropriate apex of the big triangle. 340Which suﬃces for proving impossibility when k=2.

265 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

triangulations. It is easy to see that this coloring is Sperner341. Finally we can make sense of how configurations are modeled in this geometric picture, and define indecisive configurations. Consider any finite schedule s = σ1, σ2, . . . σm, and assume that µ(s) lies in the interior of a triangle Tm in Dm. Applying the program π to the initial configuration C0 and schedule s arrives at some configuration Cm, which we can associate to this triangle. Define Cm to be indecisive iff this triangle is rainbow colored. The rationale is simple: by definition of µ and the labeling scheme of triangulations, s can be extended in three different ways, so that each will reach a different vertex. Hence there are three reachable configurations from Cm reaching three different colored vertices, namely different committed values. This is precisely being indecisive! Concluding, as we start from a rainbow triangle, D0 = T0, Sperner’s lemma allows us to choose an infinite sequence of nested rainbow triangles Tm. Their intersection defines an infinite schedule, and the infinite sequence of configurations Cm defined by the program π starting with the initial configuration C0 and following s are all indecisive! Hence no processor can commit on this schedule s in finite time, contradicting the assumption that π is wait-free.

General input-output problems and simplicial homology We continue to focus here on the shared memory model with fail-stop faults. As mentioned above, the paper of Herlihy and Shavit [HS99] does far more than prove impossibility for k-set agreement. They consider all distributed tasks of this type, namely all input-output tasks, an extremely rich set of problems roughly defined as follows. Intuitively, it allows any way of specifying which outputs are legal for each input, while including the possibility of participants failing. More precisely, fix any alphabet ΣI of input values and any alphabet ΣO of output values. We assume that each contains a distinguished symbol ⊥ (essentially denoting that a player can become inactive, or doesn’t participate). Fix n to be the number of players. An input-output task is simply n n any relation ∆ ⊆ I × O, where I ⊆ ΣI and O ⊆ ΣO, which satisfy two natural closure properties: I and O are monotone sets under the ⊥ symbol (namely, replacing the value in any component of a vector in the set by ⊥ leaves it in the set), and ∆ is consistent under ⊥ (namely, for any (i, o) ∈ ∆, if ik =⊥ then also ok =⊥). Their main result is a precise characterization of the possibility or impossibility of a wait-free concurrent program for every such task! The characterization is in purely topological form, making no reference to protocols. This enables the use of topological tools to determine possibility for every task. Here is a simple example of this power: a wait-free algorithm for 2-processor consensus exists if and only if there is a continuous onto map from a connected set in Euclidean space to another, disconnected set!. The latter is patently impossible, and hence so is the first. More generally, the paper sets up natural topological spaces, called simplicial complexes, Iˆ corresponding to the possible inputs I and Oˆ corresponding to the possible outputs O, so that every input/output vector corresponds to a simplex in the input/output complex. The characterization now becomes the question of the existence of a nice enough map between the two spaces. A bit more precisely (with undefined terms): a wait-free algorithm for the distributed task ∆ exists if and only if there is a simplicial map from a subdivision of input complex, to the output complex, that respects ∆. We will not be more precise, nor define these terms here, but will note that a simplicial map between complexes is an analog of a continuous map between topological spaces, and that the

341 A vertex vi of T corresponds to a schedule where only player i ever gets to write, and so π must let it commit to its own value. Similarly, every point on the interval [vi, vj ] correspond to schedules in which only these two players participate, and so the committed value must be one of theirs.

266 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

subdivision mentioned is an extension of the triangulation we discussed earlier. Indeed, the notion of a subdivision is what captures the protocol in this language, and we have seen this analogy in the proof of the impossibility of k-set agreement. In fact, when specializing this general set-up to the k-set agreement problem, the non-existence of a simplicial map follows easily from Sperner’s lemma. In more general situations, tools from homology theory, which provide more sophisticated invariants of topological spaces (like higher dimensional notions of connectivity and “holes”, homology groups etc.) can be used to demonstrate the non-existence of the required map, as indeed is done in the original paper. As mentioned, further examples and extensions of the power of the topological method can be found in the book [HKR13].

19.5 Local synchronous coloring We end this chapter with some positive news. There are plenty of impossible tasks in the asynchronous model which become possible when the players have a common clock (in particular, consensus and dining philisophers are such problems). We give another example, local coloring, which suits us well as it brings together (a variant of) the renaming problem and computation in a ring of processors, both of which we already discussed. But I had two much better reasons for choosing this gem, besides this convenience, locality and determinism. First, it demonstrates how surprisingly powerful and efficient a very loosely connected distributed system can be, despite the myopic view of individual processors limited by locality. Second, it demonstrates that, while randomness is an amazingly powerful way to break symmetry in distributed environments as we saw earlier, there are natural tasks of similar nature which can be solved deterministically! Here is the set up. Again we have a set of dining philosophers {Pi} sitting around a table. Each can communicate only with its left and right neighbor. Each has an initial input value xi from the set [n] which is a legal coloring of the cycle, namely, each philosopher’s initial value is different from those of its two neighbors. Note that there is no bound on the number of philosophers; indeed it can be infinite! Despite this, the input values allow them to eat at a fixed, finite rate, with each philosopher sure to get a meal every n steps. How? Well, they have a common clock now, and they proceed in rounds modulo n. At time step t, every philosopher Pi with xi = t mod n takes the two (available!) forks, eats for one time unit and puts them back on the table. So far so good, but they are really hungry, and n can be huge, too huge a time to wait for the next meal (more seriously, it is clear that the rate of utilizing shared resources is important in numerous applications). Can one increase the rate? Sure! After all, every cycle can be legally 3-colored, so an external party knowing such a coloring could have given them values from {1, 2, 3} that would allow each to eat every 3 steps. However, this is a distributed environment, and there is no such external party — they have to fend for themselves. How fast can a local algorithm, in which they exchange messages with their neighbors in each step, allow them to find such a legal 3-coloring starting from every possible n-coloring as above? This is the n → 3 coloring342 of problem343 at hand! It is not even clear that such renaming can be found in any finite number of steps! Note that, in a T -step local algorithm (ignoring message sizes for now), every processor can find out everything about every other processor at distance T from it in the communication network connecting them (here the cycle). So, the diameter of the network is an upper bound, and for many tasks, a lower

342It is a renaming problem as the processors choose diﬀerent names, from a smaller palate, but now the consistency requirement is of a diﬀerent nature. 343One can, and we will, consider n → m coloring for any m < n.

267 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

bound as well (e.g. consider the 2-coloring problem of an (even) cycle [Lin92]). But here we have no bound on the size of the network (which for a cycle is also essentially the diameter)! So, a finite algorithm will have to depend on the values in a small neighborhood. A natural idea is indeed to use randomness: Let each Pi choose a random color from {1, 2, 3} and check its neighbors’ values. Only a constant fraction (at most 5/9 in expectation) of processors will be in conflict (i.e. have a neighbor with the same color). Now, those without a conflict stay put, with their choice of color fixed forever. Each processor in conflict tosses again (from among its current color and the colors not chosen by either of its neighbors, leaving it at least 2 possible colors). Again, we expect only a constant fraction of these to still have a conflict, so they can repeat until there is no conflict. This idea seems to beat the diameter bound; if there are N processors altogether on the cycle, we expect termination in about log N steps, in expectation and in fact even with high probability. But this algorithm has several shortcomings. First, N might be huge. Second, they have no obvious way to know that no conflict remained, namely a time by which they know the process ended and they can start eating. Finally, they did not use their inputs—can these help? An ingenious local algorithm suggested by Cole and Vishkin [CV86] shows how they can do far better, deterministically! Indeed, the number of steps needed is very nearly a constant! Theorem 19.12 [CV86] There is a deterministic local algorithm for the n → 3 synchronous renaming problem which takes O(log∗ n) steps344. The idea is simple. Let’s see how processors can shrink the set of colors from n to 2(1 + dlog ne) in one step! Think of names as k-bit sequences, for the smallest k such that n ≤ 2k. Consider any processor P with input value x, whose (different from it) neighboring values are y on the left and z on the right. Let i be the leftmost bit for which xi 6= yi and j the leftmost bit in which xj 6= zj. Now this information suffices for every processor to create a much shorter value, maintaining the property that these values form a legal coloring. Simply the new value P chooses is x0, defined as (i, xi), (j, xj), which is of length 2(1 + k) as needed. We leave you the (slightly subtle) task of verifying the this is a legal coloring. Now, iterating this process 2 log∗ n steps results in some C-coloring with some C < 20. It is another exercise to see how in C more steps one can further reduce it to a 3-coloring. This result is important for applications seen above, as well as a general technique to achieve some kind of local (enhancement of) symmetry breaking, deterministically, in a number of steps that is nearly independent of the size of the network and its diameter. Several natural questions which arose given this work were addressed by Linial [Lin92]. First, can one do better than the algorithm above, perhaps solving this coloring problem in a constant number of steps? Second, can one handle other communication networks besides the cycle? Third, can randomness be used to improve any of these algorithms? We conclude with Linial’s answers (No, Yes, and No, respectively): Theorem 19.13 [Lin92]

1 ∗ • Any local algorithm for the n → 3 coloring problem on the cycle requires at least 2 log n steps. • There is a local algorithm solving the n → O(d2) coloring problem on any graph of maximum

344All logarithms are base 2. Recall that the log∗ function is the inverse of the tower function, namely log∗ n is the smallest number h such that a tower of 2’s of height h exceeds n, or equivalently, the smallest number of times h of logarithms we need to take, starting at n, to get below 2. This function grows extremely slowly! For example, if n is the number of atoms in the universe, estimated by 1080, then log∗ n = 4.

268 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

degree d in O(log∗ n) steps345. • If a probabilistic local algorithm solves a coloring problem in T steps in expectation, then there is a deterministic T -step local coloring algorithm for the same problem.

345And thus, also an algorithm which in O(d2 + log∗ n) steps solves the n → d + 1 sych problem.

269 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

20 Epilogue: a broader perspective of ToC

This book has focused on computational complexity theory both as a major mathematical area, describing its rich internal structure and its broad reaches into other areas of mathematics, and as a central, pivotal area of the Theory of Computation (ToC). This chapter is devoted to a panoramic view of ToC that extends far beyond the intersection of math and Computer Science. The great impact of computer technology on society tends to obscure the intellectual foundations it rests on, especially from laymen but sometimes from experts as well. Even when understood, these theoretical ideas are often viewed only as servants of the technological development. In this chapter, I will elaborate on the nature of ToC as an independent intellectual discipline, which is summarized below. The theory of computation, since its inception by Turing in 1936, is as revolutionary, fundamental and beautiful as major theories of mathematics, physics, biology, economics... that are regularly hailed as such. Its impact has been similarly staggering. The mysteries still baffling ToC are as challenging as those left open in other fields. And quite uniquely, the theory of computation is central to most other sciences. In creating the theoretical foundations of computing systems ToC has already played, and continues to play a major part in one of the greatest scientific and technological revolutions in human history. But the intrinsic study of computation transcends man-made artifacts. And its expanding connections and interactions with all sciences, naturally integrating computational modeling, algorithms and complexity into theories of nature and society, marks the beginning of another scientific revolution! The subsections below discuss at a high level various aspects of the Theory of Computation, mainly intellectual but also social and educational. This exposition aims at describing the nature and scope of the field, its evolution so far, and the important role I expect it to play across the intellectual and societal arenas. I hope it will give a useful bird’s-eye view of the field to newcomers and motivated outsiders, as well as to computer scientists. This exposition is clearly biased by my personal experience, views, and limited knowledge. The first several sections discuss the connections and interactions between ToC with many disciplines. I first discuss, rather briefly, its interaction with its “parent” fields, Computer Science and Engineering (CS&E) and Math. I then move on to describe in more detail interactions with “neighboring” fields like optimization and coding theory. Finally, I discuss at length interactions with the sciences, philosophy, and technology. Before turning to the more remote sciences, like biology and economics, we will take two important detours. One will discuss a general definition of computation, which will clarify the broad mission of ToC and how it is naturally aligned with the basic missions of all sciences. The second will give a general description of the central tenets of ToC methodology, which will clarify what new aspects ToC can bring into these joint collaborations with the sciences. After discussing connections and interactions, I will turn to some high level challenges of ToC, and then briefly discuss the role and importance of ToC research and the impact researchers can have in K-12 education. I will conclude with some personal observations on the socio-academic character of the field, which I believe partly explains its remarkable success so far, and should be preserved for future success. Taking stock of a scientific field’s history, evolution, ideas, contributions and challenges, is very familiar in fields that have existed for centuries, and numerous semi-popular books have been written on mathematics, physics, biology and others from this viewpoint. ToC, counting from Turing’s paper, has existed for 80 years (of which I have personally witnessed the last 40). I believe

270 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

that there is clearly room for such a book on ToC, which will describe and argue in more detail its achievements, goals and its independent intellectual place in the academic sphere. Moreover, I believe that such education of members of the field, academia and the public will be important for its future development. Here, I have condensed my version of such a treatment of the field into one chapter346. Besides being short, this survey is only a time capsule. I fully expect that the enormous expansion rate of the role computation plays in every aspect of our lives will likely change and expand the scope, goals and mission of ToC. As computation is ubiquitous, the potential for such expansion is unlimited. Throughout this section, ToC research will refer to the pursuit of understanding computation in all its forms rather than to the disciplinary affiliation of the researchers who perform it; while these researchers are typically affiliated with ToC, notable contributions of this nature were also made by applied computer scientists, mathematicians, and scientists of all disciplines.

20.1 Close collaborations and interactions It is hard to do justice in a few pages to the breadth and variety of interactions of ToC with its “nearby” disciplines, all much larger than it. I do not attempt to fully exposit this immense body of work. Rather I try to capture the different nature and role these interactions take from each different discipline, and how in turn they shape and reshape ToC and its reach. I start from the closest disciplines, Math and CS&E (Computer Science and Engineering) and then continue into neighboring fields. Both here, and when we turn to interactions with more distant fields, the coverage and level of detail are not uniform.

Meet the parents: CS&E vs. Mathematics As discussed in the introduction, ToC was born out of, and lived within, two extremely diﬀerent traditions, which shaped its unique character. I consider this combination of genes and environments extremely fortunate! Here are some examples. CS&E is a young and impatient ﬁeld, while math is old and patient. Research directions in CS&E are mostly driven by practice and utility, while in math they are mostly driven by æsthetics and abstraction. CS&E demands the study of real, functioning computer systems, while math demands any study to be fully rigorous, but allows imagination to run free without regard to reality. Each alone and both together generate an unending host of modeling and algorithmic challenges for ToC. I will be rather brief on both.

20.1.1 Computer Science and Engineering The immense technological achievements of the computer industry which surround us blind many, not only laymen and politicians but scientists as well, to the pure intellectual wonders which brought many of them about. ToC, besides creating the many theories underlying the technologies I mention below, has laid and continues to build the conceptual infrastructure for all computer professionals and the problems they address. Most fundamentally, this includes the ability to precisely model diverse computational settings, to formally deﬁne resources and analyze their utilization when organizing and processing information by algorithms. ToC provided drastically new and useful ways to account accessibility to knowledge (and thus assess privacy and secrecy), to the power and

346Twenty years ago, Oded Goldreich and I gave a similar treatment [GW96] of the nature and future of the ﬁeld, with the exact same conclusions of its success, promise and independence, but one that was much shorter and had far less detail.The two decades that passed, and all the additional research ToC has created since, make it easy for me to add on much more supporting evidence to these claims.

271 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

limits of randomness and interaction, to the organization, utilization and analysis of systems with many components, and to many others computational settings, some covered in detail in this book. These conceptual contributions, some of revolutionary consequences, have become ways of thought so ingrained in basic undergraduate education that they are often taken for granted. The specific contributions of theory to CS&E activities are very well documented, so I will be telegraphic here, confining myself to name-dropping. ToC has created and is still developing foundational theories which underlie much of the development of computational systems of all kinds. In many cases theory predated practice, and enabled system development347. In many cases, theoretical ideas born and developed for a particular technology remained useful after that technology became obsolete348. Here is a partial list of theories, each member of which is deep, broad and occupies volumes of textbooks (which one should study to fully appreciate the underlying theoretical foundations). It starts with Turing’s definition of computation and algorithms, and proceeds with theories of cellular automata, finite and infinite automata, programming languages, system verification, databases, computational complexity, data structures, combinatorial algorithms, cryptography, distributed systems, software engineering, randomness and pseudo-randomness, computational learning, approximation algorithms, parallel computation, networks, quantum computation, online and real-time algorithms, and many more. Needless to say, the rapidly evolving world of computer science and technology continuously supplies many varied situations to model as well as problems to solve, such as the recent sub-linear algorithms for huge datasets, differential privacy for scientific and public databases, delegation in cloud computing, population protocols in sensor networks and of course the struggle for theoretical explanations of machine learning programs like deep networks. Future technologies and applications will undoubtedly lead to new theories, more interaction and better understanding of the nature, applicability, power and limits of computation.

20.1.2 Mathematics With math, the nature of interactions developed differently. Again I will be brief, as this book has many examples throughout its chapters, with the Interlude chapter specifically devoted to a select few of them. Early on, aside from the early intimate collaborations with logic, ToC was mostly a user of mathematical techniques and results. Dealing mainly with discrete objects, it was natural that most initial interactions were with combinatorics. But as ToC broadened and deepened, its varied theories required tools from diverse mathematical fields, including topology, geometry, algebra, analysis, number theory, algebraic geometry and others. Such tools were often not readily available, or did not even exist, and so had to be developed. This formed many collaborations which led to purely mathematical results in all these areas. Another source of new questions (and the need for further tools) comes from completely new mathematical models for different computational phenomena, as some of the chapters of this book illustrate. These activities were combined with the meta-challenge of making math algorithmic; namely, efficiently finding objects whose existence was proved by some indirect or non-explicit arguments. Such questions pervade mathematics, in some

347Examples abound, and we give only two primary ones. The early theoretical blueprints of computing machines of Turing and von Neumann which unleashed the digital age is the ﬁrst. And the theoretical foundations of public-key cryptography without which enabled E-commerce and so enabled the Internet is the second. 348Again, examples abound, and we give two representatives of two phenomena. First, theories: the theory of communication complexity, designed primarily to understand area-time trade-oﬀs in VLSI chips, and has gone on to be key in numerous other areas, as we discuss in Chapter 15.2. Second, algorithms: the algorithm for pattern matching, designed initially for text processing, was, together with its extensions absolutely essential for the Genome project.

272 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

cases for centuries. Pursuing them, especially with the newly developed algorithmic and complexity tools, has led to rethinking and expanding many areas, discovering new structures and providing many new questions. These rapidly expanding collaborations with many areas of mathematics has greatly enriched ToC as well, and clariﬁed its own independent role as an important mathematical area. It is heartwarming to see how most young mathematicians are well versed in the basic notions, results, and major open problems of computational complexity, as they would be about any other math area outside their speciality. I have no doubt that the algorithmic and complexity ways of thinking will further penetrate all areas of math and will create many new interactions between other ﬁelds.

Meet some neighbors: Optimization, Coding & Information Theory, Statistical Physics I now turn to give some more details and references on the many and growing interactions between ToC and three very large disciplines which are naturally quite close to computer science. These connections are already surprisingly diverse, and in some cases have surprising origins. I ﬁnd this array of connections stunning in breadth and depth, and note again that the topic list and references we give are very partial.

20.1.3 Optimization The connections of the large optimization community with ToC is far from surprising, as eﬃcient algorithms are a core object studied by both (even though initially the types of problems and tools each community focused on were somewhat diﬀerent). However, what may not have been expected is how major breakthroughs, which mostly arose from computational complexity considerations and constructs, would enrich and rejuvenate the study of the power and limits of algorithms. Many of these are discussed in this book and include

• The PCP theorem, leading to a theory of hardness of approximation, analogous to (though far more difficult and refined than) the theory of NP-completeness. Some landmarks include [AS98,ALM +98,FGL +96,Kho02,Rag08] and some of these developments are discussed in Sections 4.3 and 10.3. It is interesting to note that the origins and methods leading to the PCP theorem are far from optimization: they include cryptography, interactive proofs, coding theory, program testing and average-case complexity. • The power, limits and connections of LP and SDP hierarchies, powerful algorithmic paradigms existing in the optimization literature, which were (and are) becoming much clearer with works like [Gri01b, Gri01a, ABL02, LRS14, BS14, CLRS16]. Some of the origins and connections leading to these developments include proof complexity, computational learning theory and random restrictions from circuit complexity. • Related and more specific to the item above is “extension” of linear programs, namely adding variables to reduce the number of inequalities. The exact power of this technique was fully characterized in [Yan91], and its limits determined first in [FMP+15] (and then further in subsequent work, also mentioned in the previous item). Interestingly and surprisingly, some of the crucial insights and methods came from seemingly unrelated areas including communication complexity and quantum information theory. • Starting perhaps with Karmarkar’s algorithm [Kar84] for linear programming, continuous optimization methods became a mainstay of ToC. But more recently momentum picked up

273 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

considerably, and the ellipsoid method, interior point method, alternate minimization, multiplicative weights and a variety of first and second order descent methods (as well as their applications), have been greatly extended e.g. in [ST04a, CKM+11, AHK12, Mad13, LS13, LS14, KLOS14, AZO14, GGOW15, AZH16] among many others. In many cases these broke efficiency records held for decades and some resulted in near linear algorithms. Connections and tools range from electrical flows and random walks to permanent approximation, spectral decompositions and functional analysis. • The Exponential Time Hypothesis (ETH) has been proposed as a natural but much stronger hardness assumption than P= 6 NP in [IPZ01, IP01]. The ensuing active theory, often called fine-grained complexity, (as it introduces also more delicate notions of reductions between optimization problems) enables predicting the precise complexity of problems inside the class P, and in particular ruling out linear time algorithms (see e.g. the survey [Wil15]). • Smoothed analysis, introduced in [ST04b], provides a radically new way of analyzing heuristics, very different from all previous average-case models, and serves to explain their success on “typical” inputs in a new way.

20.1.4 Coding and Information Theory The connections of ToC with the vast ﬁeld of coding and information theory are extremely broad, ranging from very expected to very unexpected. Most expected connections have to do with the fact that computations (in computers, networks of computers, databases etc.) process information which is subject to noise and error, and so must be designed to be fault-tolerant. This naturally begs the use of error-correcting codes and information theory. The less expected connections include the introduction of locality into error-correcting codes (in several ways), the rejuvenation of several old ideas and models (like list-decoding, low-density parity-check codes, and the role of interaction in coding and information theory), with new questions, applications, techniques and results. We list and reference some of these below (and note again that some are discussed throughout the book, especially in the chapter devoted to the interactive aspect).

• The idea of list-decoding, namely that codes can tolerate far more noise if decoding is relaxed to produce a short list of potential messages, as opposed to a unique one, goes back to the very early days of coding theory [Eli57]. Forty years later, starting with the breakthrough work of Sudan [Sud97], a sequence of works including [GS98, PV05, GR08] quickly led to optimal list-decodable codes with efficient encoding and decoding algorithms, and the study of list decoding for many different codes. • In contrast, the idea of studying local decoding arose from complexity theoretic considerations in cryptography, derandomization and PCPs. In local decoding only one (specified) bit of the original message should be recovered from a noisy encoding of it, but only a tiny (random) fraction of it can be inspected, and small error is allowed. Remarkable constructions and applications appear e.g. in [GL89, STV99, KS09,Y +12, Efr12, DSW14, DG16] and in many others. As one example of an application, the related locally repairable codes of [GHSY12] and its followers had a tremendous effect on the design of distributed data centers of Internet data, where recovery from fault and consistency across multiple copies became a completely new challenge at these volumes and speeds. Some of the many complexity theoretic applications of local decoding (often combined with list decoding) can be found in the survey [Sud00],

274 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

and many others, in algebraic complexity, combinatorial geometry and information retrieval appear in some of these references. • Local testing of codes is another new coding problem which was born from computational complexity considerations of program testing, interactive proofs and PCPs was. Here one simply asks if a given word is in a given code or very far from it (in Hamming distance), again by inspecting only a (random) tiny part of it. Once more, remarkable constructions and applications were found, e.g. in [BFL91,BLR93,AS03,RS97,GS00,GS06,IKW12,KMRZS17, DK17]. • In the reverse direction, the idea of concatenated codes [For66], developed in coding theory to construct explicit, efficient codes, inspired many of the proof composition constructions of PCPs and related systems. Other notions of robustness as well as actual constructions were borrowed, directly and indirectly, from the recovery from errors in robust codes to recovery from errors in robust proofs. • “Graph-based” or LDPC (Low-Density Parity-Check) codes were first proposed and studied in the seminal work [Gal62]. However, this direction was left mostly dormant until a surge of interest and results brought it back 30 years later, much due to the rise of expanders (discussed in Section 8.7), graphs with diverse applications in ToC. These initial works include [Spi95, SS96, LMSS01, RU01, Lub02, CRVW02]. • Interactive computation was always part of information theory. Nevertheless, communication/information complexity, and interactive coding theory have emerged and grew to two well-developed theories within computational complexity, with major applications within the field. These theories have considerably enriched the interactions with coding and information theory. Both are described in Chapter 15.

20.1.5 Statistical Physics It may seem surprising that I include statistical physics a neighboring field to ToC, but many natural connections and common interests between the two were discovered very early on, and have led to significant collaborations (that naturally included also discrete probability and combinatorics). Moreover, many of the problems and methods of statistical physics are naturally algorithmic as we shall presently see. I will briefly survey this common ground, so as to better appreciate the new interactions (making this section somewhat longer). A central theme of statistical physics is understanding how global properties of a large system arise from local interactions between its parts. A commonly given example is the global states of matter: gas, liquid, solid, and the transition between them (i.e. turning ice into water and then into vapor) under temperature change, which affects the movement of molecules and the local interactions between neighboring ones. Another common example is magnetization under the influence of an electric field. A system is typically described by a graph or hypergraph whose nodes represent the interacting parts, each of which can be in some finite number of states, and whose the edges represent the local structure. Prescribed functions determine for each local part its contribution to the total energy of the system. For each possible state q of the system – where q is a vector of states of every part – one then adds the local contributions to define the energy of the whole state E(q). Being a statistical theory, the state of a system is a random variable q drawn from a probability distribution, which is determined by the total energy, usually proportional to exp(−βE(q)). The

275 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

P proportionality constant Z = q exp(−βE(q)) is called the partition function of the system; a central object of study in this theory. Here β is a global parameter (like temperature) which controls the strength of local interactions. Determining global properties of the system (mean energy, long-range correlations and others, many encoded in the partition function) is generally reduced to sampling a state according to the above Gibbs distribution as it is commonly called. This sampling problem is a natural computational problem! Note however that the number of states is exponential in the size of the system (the number of parts), so it is nontrivial. This (discrete) formalism captures a large number of models of matter of all types, including spin systems on glassy and granular matter, electromagnetic systems (both classical and quantum), “hard-core” interactions, percolation in porous materials, and others. Many other variants we will not discuss include continuous settings like heat baths, Brownian motion and other diffusive systems, and non-linear interactions, e.g. the Maxwell-Bolzman ideal gas model (which gave birth to statistical physics), billiard models etc. It is not hard to see that the discrete formalism above naturally captures and indeed generalizes constraint satisfaction problems (CSPs) like e.g. 3−SAT , which I discussed in several sections of the book. Description of such systems (the interaction graph and the local energy functions) comprise the input data to many optimization problems of algorithmic interest, except that typically one asks not to sample a random state, but rather to find one that (exactly or approximately) optimizes the energy. Similarly, in combinatorics, the same data is considered as input to many enumeration problems, i.e. counting the number of states with optimal (or specific) energy. It turns out that all these computational problems, sample, search, count, are related, which naturally fosters interaction that we will discuss. A sampling method originating with von Neumann and Ulam in the 1950s, developed partly for the Manhattan project, is the so-called Monte Carlo algorithm, which was subsequently further developed. In the framework above, one sets up an (exponentially large, implicitly described) Markov Chain on the states of a system, whose stationary distribution is the Gibbs distribution (this is called the MCMC method, for Markov Chain Monte Carlo). Then, starting from an arbitrary state, one proceeds with the natural random walk on the chain in the hope of converging quickly to a typical state as required. Natural algorithms of this type include the Metropolis algorithm and Glauber dynamics. Numerous simulations of such chains were and are carried out to determine properties of numerous models. However, few tools existed, for precious few systems, that could rigorously quantify the convergence rate of these algorithms, and so heuristic arguments (and resource limitations) were used to cut off the simulation time. Needless to say, if the random walk did not converge, the information deduced from about the global state of the system could be completely wrong. And of course, MCMC may not be the only way to sample! Interaction with ToC started when the field began investigating probabilistic algorithms in the 1970s, of which MCMC is a perfect example. This has led to significant progress on the sets of problems described above regarding local interacting systems, which we briefly summarize.

• Valiant’s complexity theory of counting problems [Val79b,Val79c], introduces the complexity class #P, and establishes that Permanent of Boolean matrices is complete for this class. This allows us to demonstrate hardness of almost all natural enumeration problems above, and with them, the hardness of computing the probabilities in the associated Gibbs sampling problems. • To sweeten the pill, Jerrum, Valiant and Vazirani [JVV86] prove that sampling is equivalent, for most problems of interest, to approximate counting. This provided a key connection that

276 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

makes sampling algorithms applicable for solving enumeration problems. • A series of papers by Jerrum and Sinclair [JS89,SJ89] provided general methods of canonical paths and conductance to bound the convergence of general Markov chains, which they used to rigorously prove polynomial convergence for problems in statistical physics like the Ising and monomer-dimer models, and enumeration like counting matchings in graphs. These papers had a flood of follow-ups, developing these and other methods, including rigorous ways of using various forms of coupling. Many early examples are summarized in [JS96]. • The important work of Jerrum, Sinclair and Vigoda [JSV04] gave a polynomial time probabilistic algorithm to approximate the permanent of non-negative matrices, which by completeness (above) captures many other enumerations problems. Efficient deterministic algorithms for the permanent, albeit with only an exponential-factor precision [LSW00, GS14], exposed connections of these problems to matrix scaling and hyperbolic polynomials. These aspects and many more are exposed in Barvinok’s book “Combinatorics and complexity of partition functions” [Bar16]. • The connection between spatial, structural properties of local systems (e.g. long-range correlations in the Gibbs distribution, phase transition) and temporal, complexity theoretic properties (e.g. convergence time of natural Markov chains like Glauber dynamics) has been studied by physicists in spin systems since the 1970s. This connection was expanded by the work Weitz’ [Wei06] to the hard-core model; he developed a deterministic algorithm (very different from the Markov chain approach) which is efficient up to the phase transition. This was complemented with a a hardness result of Sly [Sly10] just above the phase transition. This triggered further collaboration and better understanding of this deep relationship between spatial and temporal mixing (see [DSVW04] for a survey). • The Lovasz Local Lemma (LLL) enables us to establish the existence of rare “global” events. Efficient algorithmic versions of the LLL were initiated by Beck [Bec91], and starting with the work of Moser [Mos09] (and then [MT10]), have led to approximate counting and uniform sampling versions for rare events (see e.g. [GJL16]). These new techniques for analyzing directed, non-reversible Markov chains are a new powerful tool for many more applications. A completely different deterministic algorithm of Moitra [Moi16] in the LLL regime promises many more applications; it works even when the solution space (and hence the natural Markov chain) is not connected!

• Finally, Markov chains like the Metropolis algorithm, guided by an optimization objective like energy, have been used for optimization in heuristics like simulated annealing, to generate Gibbs distributions that favor states of high objective value. Some of the techniques above allow analysis of convergence time for classical speciﬁc optimization problems (see e.g. [JS93] for upper bounds and [Jer92] for lower bounds).

20.2 What is computation? As we now move away from interactions of ToC with neighboring fields to (seemingly) more remote ones, we take a higher view. It is fitting at this point that we should explain first, as we discuss the theory of computation, what we mean by the term computation. One of the broadest ways to informally “define” computation, indeed the view which underlies the celebrated Church-Turing

277 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Thesis (which is discussed more later) is as follows. Computation is the evolution process of some environment via a sequence of “simple, local” steps. If this definition seems to you as capturing practically any natural process you know of, that’s precisely how I want it to sound! Of course, the definition above calls for a specification of the evolving environment, and a notion of granularity that will distinguish local and global, simple and complex. The most basic setting (from which the word “computation” originally arises), in which bits evolve in a Turing machine or Boolean circuit, offers one example of the granularity notion, and the rules/steps of evolution. Another, still with actual computation, but completely different granularity and basic steps, arises as we can consider the evolution of the states of processors in a network under, say, pairwise communication. And there are many other choices which capture other (existing or imagined) computing systems. The main point I wish to make is that this viewpoint of processes as computation extends to numerous other settings, vastly removed from computers. In each setting, many different choices of granularity, and simple and local rules (which may be given by nature, or made up by us), will lead to different evolution processes. All of these are worth studying (even when physical) as information processes from a computational perspective, using the methodology of ToC that we elaborate on in the next section. Here is a partial list of environments with such interacting parts, which in all cases can shed their physical characteristics and be viewed as transformations of pure information. All of these are playgrounds where theorists of computation349 have a role to play! The computational modeling and quantitative study of the resources expanded by all such processes, what they “compute” and other properties of this evolution, is the bread and butter of ToC. • Bits in a computer. • Computers in a network. • Atoms in matter. • Neurons in the brain. • Proteins in a cell. • Cells in a tissue. • Bacteria in a Petri dish. • Deductions in proof systems. • Prices in a market. • Individuals in a population. • Stars in galaxies. • Friends on Facebook. • Qubits in entangled states. These and many other similar examples clarify that the notion of computation far transcends its (natural and essential) relevance to computer technology, and demonstrate the need for a theory of computing even if computers did not exist at all! 349And these can come from every discipline.

278 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

20.3 ToC Methodology As we have seen above, many natural and man-made phenomena present us with processes we would like to understand, and the many problems of practical and intellectual importance present us with the need to develop eﬃcient ways to solve them. The theory of computation has created a powerful methodology and language with which to investigate questions of this type. Here are some of its (interrelated) important principles, which we have seen in action repeatedly in the previous chapters of the book, and should be considered in the general context of computation we discussed above. Let me stress that most of these principles are not new; they have been in use in many studies across science and mathematics for ages. I feel however that they are handled in a more systematic way in the context of the theory of computation, and in a sense, some of these principles themselves become objects of study of the ﬁeld. I expect that their more systematic use in math and other sciences would be rewarding, as existing interactions (some of which are discussed in the following sections) already reveal.

1. Computational modeling: Uncover and formally articulate the underlying basic operations, information flow and resources of given processes. This book has many examples of computational processes with a large variety of basic operations, like Boolean or arithmetic gates, which can be deterministic, randomized or quantum. We have seen e.g. geometric, algebraic and logical deductions in proofs. In all of them we have studied time, space, communication, randomness and other resources. Beyond CS and math lie a vast number of natural processes expanding different resources, many of which can be viewed as information processes. Model- ing their basic steps and resources as computation, and applying the computational language, methodology and results may be extremely beneficial in the sciences. Moreover, the abstract, computational understanding of natural processes may feed back into computer technology by integrating algorithms and hardware used by nature, as initial attempts in nano computing, quantum computing, DNA computing, swarm computing and others promise. 2. Algorithmic Efficiency: Attempt to minimize relevant resources used by computational processes and study their trade-offs. It should be stressed at the outset this principle applies equally to algorithms designed by a human to solve a problem, or by deep networks trained on massive data to self-improve, or by algorithms which evolved in nature over eons to guide the behavior of living organisms. In all, economizing resources is primary (even inanimate physical objects seem to prefer low energy states). Experience shows that studying the limits and trade-offs of efficiency is a great classification guide for problems and processes. More- over, developing general analytic tools to find the limits and trade-offs of efficiency in one computational setting can be extremely powerful in others. 3. Asymptotic thinking: Study problems on larger and larger objects, as structure often reveals itself in the limit. There is a natural, practical tendency to focus on understanding (or developing algorithms for) concrete, specific objects which we really care about, which have specific sizes (e.g. the human genome, the Facebook graph, the roadmap of the US, Rubik’s cube, the proof of Fermat’s last theorem, etc...). However, viewing such concrete objects as parts of infinite families, to which the same process or algorithm applies, may lead to more efficient and more general methods of treating even these particular individual ones. Some of the major successes of the field stem from applying the asymptotic viewpoint, and numerous algorithms, reductions and complexity classes demonstrate this clearly. This approach has parallels in other fields. In coding theory, Shannon’s asymptotic approach revolutionized

279 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

digital communication and storage (despite the fact that all technological applications have very specific finite parameters). In physics this approach is often called the thermodynamic limit. In mathematics the asymptotic view is natural in discrete settings like set systems and graphs (although some parameters of continuous structures are viewed asymptotically, like dimension, genus, and continuity itself). Making discrete structures continuous and studying various limits uncovers hidden structure as well; perhaps more of that can be applied to the study of computation. The recent development of a limit theories of combinatorial objects (see e.g. the comprehensive book [Lov12]) is a promising example. 4. Adversarial thinking: Prepare for the worst, replacing specific and structural restrictions and constraints by general, adversarial ones—more stringent demands often make things simpler to understand! A recurring theme across the theory of computation is that surprising algorithms and protocols are discovered when the models at hand allow stronger (rather than weaker) adversaries350. While seemingly counterintuitive, such a handicap (or worst-case view) often shines a light on an idea that may be obscured by specific details. And clearly, positive results, namely upper bounds and algorithms, if they exist in such generality, are much preferable. Of course, equally often lower bounds are found in general adversarial settings; such negative results call for formulating more specific assumptions, under which the problem we care about does have a solution. But even then, guidance in modeling on how to restrict adversaries and avoid hardness can often be gleaned from understanding how and why algorithms fail in the presence of more general adversaries. The theory of cryptography in particular, where adversaries are typically restricted solely in their computational power, has been extremely successful due to this very choice, which perfectly fits computational complexity theory. 5. Classification: Organize computational tasks into (complexity) classes according to the amounts of various resources they require in various models. Classification is natural across the sciences, but it is most often based on structural properties of objects. What is seemingly surprising in computational complexity is how a huge number and variety of problems snugly fits into relatively few complexity classes characterized by resource requirements, as well as the strong connections between classes defined by different resources. Of course, central open questions of the field are mostly about proving that certain pairs of classes are actually distinct. One could imagine the potential power of this type of computational complexity based classification in other sciences, e.g. of synchronization or coordination processes in natural distributed systems, or e.g. of word problems and isomorphism problems on groups and algebras and manifolds in mathematics. 6. Reductions: Ignore your ignorance, and even if you can’t efficiently solve a problem, assume that you can, and explore which other problems it would help solve efficiently. Despite furious arguments between philosophers on the power of “reductionism” to understand the world, understanding complex phenomena by breaking it into simpler parts is often responsible for great scientific discoveries. In computer science, a standard programming practice calls for using subroutines for a certain solved problem A as part of an algorithm for another more complex problem B. Algorithmic techniques make important use of such reductions. The main twist in the theory of computation is the use of reductions for proving hardness as well as easiness: in the above example, not only does the easiness of A imply the easiness of B,

350These can be inputs, distributions on inputs, schedulers, noise, eavesdroppers, etc., depending on the context.

280 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

conversely, the hardness of B implies the hardness of A. These relations produce partial orders of computational tasks under various notions of difficulty, which often also relate different models to each other. The sophistication and intricacy of reductions (which are themselves algorithms) has been raised to an art form in areas like cryptography and pseudo-randomness, where many other properties besides efficiency restrict the processes A and B. Different, mathematically rich sophistication arises in hardness of approximation reductions and PCP constructions. I have no doubt that far more structure and connections can be uncovered in fields like mathematics and biology when the language of reductions is systematically used to relate disparate problems and models. 7. Completeness: Identify the most difficult problems in a complexity class351. Combining the two items above, the following has been amazing initially, and became a natural expectation by now. Whole complexity classes of problems that can be solved in certain limited resources and environments, can be “captured” by a single “complete” problem in the class. Completeness promises (via reductions) that better algorithms for that single problem will immediately entail the same improvements for all others in the class. And conversely, to separate the class from another, it suffices to prove hardness for that single problem. For both directions, one is free to focus on any complete problem in studying the whole class. Some notions of completeness, especially NP-Completeness, turn out to be very wide-spread phenomena across many disciplines. Finding more examples of such phenomena in mathematics and science for other notions would be extremely interesting and useful. 8. Hardness: Prove intractability results — these are useful! The potential utility of tractability results, namely efficient algorithms, is obvious. However, knowing that a task is difficult (has no efficient algorithms, for some model and resource) can be as useful! It can suggest changing the model and the definition of the task in numerous practical and scientific applications. And as we have seen, hard problems can be directly used to yield positive applications, as in cryptography and pseudo-randomness. Finally, failed attempts at proving hardness have suggested surprising algorithms that may not have been discovered otherwise (a famous example is Barrington’s algorithm [Bar86]). Hardness of course is typically hard to prove, and conditional hardness is the next best thing; in this case one naturally strives to minimize and simplify the assumptions needed. 9. Barriers: When stuck for a long time on a major question, abstract all known techniques used for it so far, and try to formally argue that they will not suffice for its resolution. Introspection has been a strong suit in computational complexity, and the formal study of barriers to progress on major questions of the field became part of the field itself. It is interesting that these investigations have often led to computational characterizations of proof techniques (despite the fact that these are what we researchers develop, not the computational models we study). This results in some unexpected connections between proofs and computations, and surprising unconditional results, e.g. that no natural352 proof exists of the hardness of factoring integers. Barriers are good not only as explanations (or excuses) for failure in resolving major open problems — they will hopefully direct us to develop new, different techniques which bypass them. This has happened in the past, both in barriers to lower bounds (such as diagonalization), and barriers to upper bounds (like integrality gaps for linear or semi-definite

351Namely those which all other problems in the class reduce to in the sense above. 352In the formal sense of Razborov and Rudich [RR97].

281 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

programming). It would be interesting to see mathematical analogs of barriers for proving e.g. the Riemann Hypothesis using current techniques, which are similar in spirit to the barriers we have in computational complexity to proving P= 6 NP using current techniques. 10. Play Forget reality, ask for the impossible. Despite being grounded and strongly connected to the practice (and demands) of computer technology, some of the greatest advances and innovations of the theory of computation came from completely ignoring realistic constraints and intuitive biases about what is possible, and making up toy models and problems to play with and explore. It paid handsomely, both intellectually and practically, to seriously and thoroughly explore ideas and notions that seemed unreasonable or even outrageous when introduced. Examples include non-deterministic machines, proofs which are not always sound, placing inputs on players’ foreheads, playing Poker over the telephone, playing Chess and Go on an n×n board, pricing anarchy, counting without counters, conviction without knowledge, quantum post-selection, perfect randomness, anonymous ownership, putting Sudoku and The- orem Proving on equal footing, and many many others that need more than a few words to describe. These lead to continuously making up new games and rules and tasks for Alice and Bob, Arthur and Merlin, Byzantine generals and dining philosophers, multi-arm bandits and numerous players with less catchy names occupied with, and then playing and analyzing these games. Of course, many of these were inspired by external, realistic considerations, and strong intuition of their inventors, but their abstract and free exploration were often essential for progress and understanding of the original applications and often completely unexpected ones. The fearlessness of making assumptions and exploring their consequences, or asking the impossible and investigating the minimal assumptions that will make it come true, has been a constant driving force of the ﬁeld, and will undoubtedly continue.

20.4 The computational complexity lens on the sciences I now enter a topic that was hardly discussed in the book at all, with two important exceptions: NP-completeness and Quantum Computing. On the first, I have already discussed at length in Section 3.10 how and why the notion of NP-completeness has invaded all sciences and been essential and ubiquitous in all. Let me summarize it here. “Ubiquity” may be a huge understatement in describing this rare scientific phenomenon. Scientists of all fields find the need to understand and use a very technical notion of Computer Science, and publish numerous353 articles which associate NP -completeness with whatever they are studying. Now on to Quantum Computing (which we have devoted Chapter 11 to), by now an exciting, well developed area which sparked remarkable scientific interactions as well as billions of dollars in the development of technologies for building a quantum computer. This field serves a perfect demonstration to what happens when the ToC methodology of the previous section is applied full force to the initial suggestions of the physicists [Ben80,Fey82, Deu85] about building quantum mechanical computers. We now proceed far beyond these important examples. A famous article of Eugene Wigner [Wig60], whose title captures its essence, is The unreason-

353You can amuse yourselves with Google Scholar, to see that “numerous” may be an understatement as well. Searching when is the phrase “NP-completeness” occurs concurrently with each of “physics”, “biology”, “chemistry” in scientiﬁc publications gets about a million hits. To make these numbers even more meaningful, these pairs each occur within a factor of 5 from the respective occurrence of such natural pairs as “energy, physics”, “atom, chemistry”, “life, biology” and “function, mathematics”.

282 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

able effectiveness of mathematics in the natural sciences354. Well, the effectiveness of ToC in the sciences is extremely reasonable, expected and natural, and we will give plenty of demonstrations below. This view is completely consistent with the mechanistic view of the world, underlying most scientific theories. It became known as the computational lens on the sciences, or sometimes, when quantitative evaluation of efficient resource use is primary, the computational complexity lens on the sciences. We will discuss numerous connections and interactions of ToC with diverse scientific disciplines, which focus on the integration of algorithmic and computational complexity considerations as an essential part of modeling and understanding nature. (This focus goes far beyond the vast use of computation as a tool in science, which as mentioned is of major importance in itself.) I see these activities as promising radical changes in many existing theories, and major progress in better understanding many natural phenomena. Before starting, let me point out that the computational element in scientific theories and models was always present (though often only implicitly). This followed both philosophical and practical considerations that long predate computational theory. First, while philosophers and scientists debated for centuries the precise properties of a scientific theory, all agree it should be predictive, namely be able to supply (or guess well) the result of a new experiment before it is carried out. Without such predictive power a theory is typically useless. Moreover, this predictive ability is necessary for the requirement of falsifiability: the existence of potential experiments that prove the theory wrong. But prediction is patently a computational task! Initial data is fed to the model as input, and the expected result must be supplied as output (e.g. “at what time will the sun or the moon rise tomorrow over New York?”). If this computational task is impossible or even merely intractable, then again the theory is useless. The need to solve computational problems in order to make scientific predictions was an essential component of the efforts of great scientists (as one famous example, Newton’s Principia contains ingenious efficient algorithms for such prediction tasks). What has changed with the arrival of ToC and computational complexity was the ability to mathematically formalize and assess the tractability of these computational tasks. Again, the pioneers of the field, Turing and von Neumann, already had a clear vision of natural processes as computational ones, and that this view is essential to understanding nature. And as was typical of these giants, they did not deal with trifles. In one of the most cited papers in biology, “A chemical basis for morphogenesis”, Turing [Tur52] set out to give a “model of an embryo”, that will explain the emergence of structured asymmetry and inhomogeneity (dominant in every living organism, with catchy examples like the color patterns on zebras, or left- and right-handedness) in a process which starts from symmetric, homogeneous initial conditions and follows symmetric evolution rules. von Neumann was even bolder. In his book “Computation and the brain” [VN58] he built the first significant bridge between computer science and neuroscience. In this remarkably prescient document von Neumann compares and contrasts computers and brains, and uses Turing’s universality, the digital nature of neurons’ outputs and most up-to-date knowledge in both (young) fields to show how much they can gain from interaction. In his book “Theory of self-reproducing automata” [VNB+66] he takes on the ultimate challenge, comparing machines and living creatures, and modeling life, evolution and reproduction. His universal constructor, a 29-state (universal) cellular automaton capable of self-reproduction is essentially using Turing’s duality of program and data for replication, predating the soon-to-be-discovered355 double-strand structure of DNA in which the same duality is used in natural reproduction. It seems almost sinful to give one-sentence

354This article was debated and interpreted by many after being published. 355This book was published long after his death.

283 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

summaries of these detailed and ambitious seminal works, and I hope the reader will find out more, and especially appreciate how natural computational modeling is for complex biological systems. It took the theory of computation several decades before plunging back in earnest to continue in these giants’ footsteps and integrate the computational approach into a much wider variety of scientific disciplines. These decades were essential for the internal development of ToC: many new computational models and types were studied, and the focus of computational complexity created a far better understanding of efficient utilization of various resources by various algorithms, and of arguing limitations and trade-offs on that efficiency. This fit perfectly with the modeling of nature, in which efficient utilization of resources is the law of the land. The past three decades have seen a boom in the invasion of algorithmic thinking and computational modeling into many fields in the natural and social sciences. In many cases, visionary leaders of these fields have recognized the importance of the computational lens and suggested integrating its study; famous examples include Herb Simon’s Bounded Rationality (see [Sim57]) in Economics and Richard Feynman’s Quantum Computing (see [Fey82, Fey86]) in Physics. In many other cases, either following such cues or independently of them, visionary leaders of algorithms and computational complexity, armed with the powerful methodology and knowledge of this field and with a passion for understanding another, have turned to propose the integration of the computational view to classical scientific questions. What is exciting is that some of these have turned into real interactions, with growing collaborations, joint works, conferences and experiments. Of course, the difference in cultures and language, knowledge barriers, and simple caution and conservatism make some of these interactions move slower than others. Also, note that each of these fields is typically vast compared to ToC; this often limits interaction to specific subfields and problem areas. Still, there are already plenty of stories to tell. There is no doubt in my mind that the algorithmic lens on sciences is the global scientific paradigm shift of the 21st century. We are only witnessing its beginning. The computational models proposed will evolve and new ones will be born, with more interaction, with novel experiments they will suggest, and with the absorption of computational methodology. These will naturally allow experimental sciences to become more theoretical, create further connections with mathematics, and interact even better with the complementary revolution of automated scientific discovery. This development will necessitate the education of every future scientist in the theory of computation. The following stories give some illustration of computational and algorithmic modeling in a variety of different areas and problems across a remarkably diverse set of scientific disciplines. This selection is based on my biases and limited knowledge, and focuses mostly on outreach of ToC researchers to these fields. It should suffice to give the reader a sense of the scope of this interaction and its potential. There is no reason to think that any of the models or theories proposed is “correct” or final. Rather, the point is that computational complexity is an essential ingredient in them, and that this is typically a novelty which adds a new perspective to important problems in each field. As these collaborations expand, I view the stories here as a few drops in a huge bucket to fill. And yet, the combined impact of very few decades of such interactions is, in my view, amazing! Note that I will not discuss at all the many important ways, in which the direct use of algorithms, computer systems and technology interact and impact the sciences, including analyzing and interpreting vast amounts of scientific, social and medical data, simulating scientific models and processes, etc. This interaction is yet another revolution, which is beyond the scope of this chapter.

284 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

20.4.1 Molecular Biology Perhaps the fastest, largest and most important growth of interaction between biologists and computer scientists has started with the Human Genome Project at the turn of the millennium. The combination of new sequencing technologies with new efficient algorithms to analyze the outputs these produced gave birth to Computational Biology (or Bioinformatics) (see e.g. [Pev00,JP04] for earlier works on this collaboration). These fields grew to encompass all aspects of molecular biology and genetics, disease discovery and drug design, with similar collaborations combining modeling and algorithms, both man made and of the machine learning variety. These collaborations, in academia and industry, probably dwarf in size everything else we mention combined! In a reverse twist, computer scientists [Adl94,Lip95] initiated and studied DNA computing, the potential use of large molecules like DNA to faster solve difficult computational problems. Despite the slower speed of molecular processes in comparison with electronic ones, it seemed to offer immense (albeit, constant) parallelism at very low cost. This was indeed demonstrated in the lab by Len Adleman in his pioneering paper [Adl94]. Note that universality of this computational model was not obvious, but was demonstrated in vivo by [BGBD+04], with potential medical applications to cellular-level diagnosis and treatment!

Figure 23: Cube and tetrahedron from DNA strands, from Ned Seeman’s lab

Besides computing functions in the usual sense, Ned Seeman [See04] envisioned the design and physical construction of nano-materials from initial DNA and other molecules. The pictures demonstrate our ability to program DNA-like molecules to have certain atoms in certain positions which will interlock Lego-style with other ones to yield many diﬀerent structures which are completely unlike anything nature does on its own (see ﬁgures of a cube and tetrahedron made by the carefully designed DNA strands in Figure [?]). See also e.g. [RPW04,BRW05] for more algorithmic techniques and resulting structures. The ability to program such nano-level organic designs for a variety of functional and structural medical purposes is extremely promising (see e.g. [KSZ+10]), especially as one can build not only rigid structures but also moving machines (see e.g. [GV08]). The same may

285 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

be said of nano self-assembly for other materials (see carbon-based, e.g. Chapter 11 of [TPC15]). And indeed, there has been a growing flurry of joint activity of biologists and computer scientists on models and algorithms for “programmable matter” (see e.g. this workshop report [DK16] and this thesis [Der17] for recent examples). In all technologies the tolerance to errors is a key issue, and fault-tolerant self-assembly is a major thrust in this effort - see the survey [Win06]. It is clear that these exciting abilities beg a general theory of the underlying “programming languages” whose basic building blocks are nano-materials, and whose basic operations use chemical or physical bonds. Studying the expressive power (namely, which “architectures” are possible and at what cost) of such languages (and ultimately, designs) is certainly on its way as exemplified above, in parallel with the technological developments. These create new challenges for ToC researchers, and I fully expect much more collaboration in this area.

20.4.2 Ecology and Evolution The fact that computational complexity is essential for models of nature was already clear to Charles Darwin in his Origins, and this was at the heart of one of the most interesting controversies in the history of science! Darwin took pains to approximate the age of the Earth, in order to check if his theory of evolution is consistent with the time it took life on Earth to reach such a level of diversity. In his day the (religious) dogma was still that the Earth is 6000 years old, and it was clear to Darwin this was far from sufficient for mutations, reproduction and natural selection to reach that diversity from one common origin. Luckily, the science of geology was being developed just then, and Darwin used it to estimate Earth’s age at a few hundred million years, which seemed satisfactory to him356. But he became greatly upset (as he confessed in a letter to Wallace) when learning that the great physicist William Thomson (later Lord Kelvin) had estimated the age of the sun (based on its energy, according to the best physical theories of the period) only at a few tens of million years (roughly a factor of 10 lower than Darwin). This time estimate seemed to Darwin as having the potential to falsify his theory. Of course, as we know, Thomson was very wrong (as nuclear forces were discovered much later), and the age of the Earth is roughy 10 times higher than Darwin’s estimate. But the message of this story is completely clear. Any natural process expends resources (like time in the story above), and so “computational complexity” must be an integral part of the relevant theory’s consistency (and falsifiability). Indeed, better computational modeling of evolution processes and their complexity may lead to a revision and better understanding of this celebrated theory. Building a quantitative, computational theory that will explain the complex mechanisms which evolved (e.g. in the cell) from simple ones through variation and selection has been the quest of Les Valiant in the past decade, starting with his paper “Evolvability” [Val09]. He views evolution as a restricted form of his PAC learning methodology, that we explained in Chapter 17. Rather than going into any details, let me suggest Valiant’s exciting and extremely readable book Probably, Approximately Correct [Val13] in which he expounds his theory, and in particular the notion of Ecorithms: algorithms which interact with their environment. From this very general question and model for evolution we turn to discuss two specific conundrums, whose resolution I believe will involve computational complexity. Some initial suggestions in this direction have been made. 356Needless to say, this time estimate and its sufficiency for Darwin’s theory relies on many assumptions, which he gives in detail.

286 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

The celebrated “problem of sex” (called the queen of problems in evolutionary biology by Gra- ham Bell), asks to explain the prevalence of sexual reproduction in nature, in the face of its cost in energy and the loss of genetic material (which may have been improving by selection) in the process. After all, asexual reproduction seems far cheaper energetically, and can continuously improve fitness. Of course, these simplistic considerations were only the beginning of a lengthy historical debate and many theories that are far from resolved. Here I would only like to point out, again without detail, recent contributions towards a quantitative, computational, and very different proposal by a combined team of evolutionary biologists and complexity theorists [LPDF08], which was further explored and expanded in these (and other) papers [LPPF10, CLPV14, MP15, LP16]. Yet another mystery of evolutionary biology is the “problem of conflict”. Roughly it asks how is it that creatures, optimized by evolution over millions of years experience, can “freeze” by an inability to resolve a conflict between very different alternatives. This phenomenon has been observed in many species and situations (humans are extremely familiar with it), and as the one above, received plenty of debate and differing theories. Another collaborative work [LP06] suggests an intricate computational model in which evolution of a system towards optimal behavior may organ- ically create within itself two subsystems which can be at odds with one another! Computational limitations play a crucial role in this model. Concluding this section, let me discuss the very general problem of understanding some very different algorithms of nature from a very different angle.

Figure 24: Search “starling murmurings” for amazing videos!

It is nearly impossible to watch the videos of many thousands of birds (the still pictures in Figure /refStarling do not begin to make this impact) without, following disbelief and awe, seeking to understand the mechanism that allows this distributed system to produce such spectacular complex yet coordinated behavior. And indeed, for decades these (and numerous other forms of remarkable coordination and action by many other species) have been studied by scientists and mathematicians. I would like to point out one very general discrete model of such a phenomena, called influence systems, that was proposed by Bernard Chazelle (see his surveys [Cha12, Cha15]). It attempts to capture the dynamics of a distributed network in which the topology is changing by that dynamic itself. This model is relevant not only to the natural systems and algorithms but also to many dynamic social situations. Chazelle’s work develops techniques to study such non-linear models, and gives the first quantitative upper and lower bounds on convergence times in bird flocking and similar systems.

287 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

20.4.3 Neuroscience Unlike many other scientific problems discussed in this section, the quest to understand the brain (especially the human brain!) always had a significant computational component, as the brain is generally regarded as an (albeit terribly complex) computational device. Very early works in computational modeling of the brain include McCulloch and Pitts’ nerve nets [MP43] (a collaboration of a neuroscientist and a logician) and the aforementioned book of von Neumann on the subject [VN58]. Great advances in biological techniques and in computational power have led to better and better understanding of neurons, the connections between neurons, and the activities of neurons during a variety of behaviors. These in turn have led to many (neural) network models of the brain, and of parts of the brain, attempting to explain various cognitive and other functions at different levels of specificity. It is interesting that the nature of many such models and the challenges in their analysis drew the interest and collaboration of physicists with biologists, which has been going on for several decades. All this represents vast and still rapidly growing work. Among numerous texts on the subject, an excellent comprehensive book surveying descriptive, mechanistic and interpretive computational models of the brain, at all levels is Dayan and Abbott’s Theoretical Neuroscience [DA01]. In what follows I would like to describe some recent interactions, taht stress the integration of computational complexity into models of the brain. I expect these interactions to grow, and lead to more collaboration and understanding357. In terms of a general computational model of the brain, Les Valiant [Val00] pioneered a comprehensive design from a computational complexity perspective. It postulates precise mathematical assumptions about the interconnection patterns between neurons and the computational capabilities of individual neurons, which are consistent with known physiological results. It then proceeds to describe detailed algorithms which could be implemented in this model, and carry out some basic cognitive functions of memorization and learning. These details include how and what information is stored in (collections) of neurons, and careful accounting of the physical and computational resources expanded by these algorithms. To me, more than an actual model of the brain (which will probably take decades to figure out), Valiant’s is a model for modeling the brain. In particular, it suggests further experiments, and is eminently falsifiable. Curiously, it even predicted the need of certain physiological phenomena (e.g. strong synapses, neurogenesis) that some of the algorithms required, and these predictions were indeed verified to some extent after the first publication of the book. Valiant further articulates principles for general modeling of the brain in [Val06]. More works attempt to computationally address more specific areas of the brain, and focus on the implementation of more specific cognitive functions. The hippocampus and memorization are further studied e.g. in [Val12, MWW16], the cortex and learning in [Val14, PV15], and the compression of information in neural tissue in [AZGMS14]. While these papers are mostly by computer scientists, they appear in journals read by (and presumably reviewed by) neuroscientists, and promise future collaboration. One of the greatest computational and algorithmic challenges in neurobiology arises from connectomics, the field which (in some analogy with the Human Genome Project, only orders of magnitude harder) attempts to map out the entire human brain, complete with all synaptic connections. Even partial success will hopefully give the ability to simulate its activities on a computer, and to better understand its processes and diseases. The very cross-disciplinary Blue Brain Project [Mar06] represents perhaps the most massive such collaborative attempt today. The “big data” challenges

357See e.g. https://simons.berkeley.edu/programs/brain2018

288 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

arising even in the decisions of which data to collect, which to keep, how to organize it, and how to go about extracting the required structure out of it are great and far from agreed on (of course, these challenges are present and increasingly so in many other areas in which unprecedented amounts of data can be easily collected). Joint work of neuroscientists and computer scientists [LPS14] attempts to articulate principles guiding this task, and possibly build a computational theory of connectomics.

20.4.4 Quantum Physics In contrast to the section above, where I focused on contributions of complexity theorists to neuroscience, here I focus on contributions of physicists, who use complexity theoretic results and methodology to suggest resolutions of conundrums of physics! As we shall see, the physicists’ quest for understanding the fundamental structure of physical space and time may need the fundamental understanding of the computational resources of space and time! We have devoted a whole chapter of this book to Quantum Computation, which was started by physicists, picked up by computer scientists, and has led to a remarkably intense and productive collaboration between the two groups, and produced new results and fundamental questions in quantum mechanics and quantum information theory. A byproduct of this interaction is the integration of complexity theory concepts and results by physicists which allow for the proposals I will now sketch. I will focus solely on Quantum Gravity, or the long-sought theory which will enable marriage of quantum mechanics and general relativity, towards Einstein’s dream of a unified theory. And I will only discuss a few (related) examples. I fully expect far more integration of computational considerations to theories in all areas of Physics, and far more interaction between the fields. It is all about black holes. If the following sounds too mysterious and far-fetched to you, know that I feel the same, and so do some physicists. We discuss physical theories that are far from being testable in the foreseeable future, and arguments regarding them rest heavily on thought experiments. Moreover, many of these ideas are recent, and are extensively debated. I will be lax and informal. For the brave who wish for detail, a technical but very readable survey, with plenty of intuition, detailing most aspects of the discussion below was written by Harlow [Har16]. It also contains all relevant references. A more informal survey that addresses these issues (with more computational complexity background) are these lecture notes of Aaronson [Aar16]. Now brace yourselves for two stories full of buzzwords, which you should accept and read on as you do with fantasies, to the (computational) punchline at the end. A fundamental connection of gravity and quantum mechanics is the Hawking radiation (while Hawking was the first to fully develop it mathematically, he used earlier ideas of Zeldovich and of Bekenstein). They discovered that, while black holes are so heavy as to swallow everything, including light around them (which is the reason we don’t see them directly), and seem doomed to grow forever, quantum effects nevertheless cause them to leak particles, and despite the extremely slow pace of this effect, black holes will eventually evaporate altogether! Hawking radiation, which is well accepted, makes it extremely difficult to stitch the seemingly conflicting constraints imposed on it by general relativity (e.g. the singularity at the center of the black hole, the smooth structure of space-time at the event horizon358 of the black hole) on the one hand, and those imposed by quantum mechanics (e.g. unitary evolution of the radiation, complementarity, no-cloning of quantum states and monogamy of entanglement). These potential

358The “boundary” of the black hole; anything inside it is trapped and falls into the black hole.

289 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

conflicts between constraints (not all of which share the same acceptance status) are explored through ingenious thought experiments. The central one at hand, called the Firewall Paradox, was suggested by Almheiri et al. in [AMPS13]. Oversimplifying, the paradox can be roughly summarized by the ability of an observer sitting outside the event horizon to extract a qubit of information from the leaking Hawking radiation, then jump into the black hole and extract that same qubit after crossing the horizon359, which is a contradiction (it would violate a basic theorem of quantum information theory called monogamy of entanglement)! Many proposals to resolve the paradox were suggested, but the one of Harlow and Hayden [HH13] (see elaboration and simplifications in [Aar16], Lecture 6) is unique in introducing a computational viewpoint which is relevant for many other issues regarding such processes. It essentially views both the black hole producing the radiation from the information that fell into it, as well as the observer who extracts the paradoxical bit from that radiation as efficient (polynomial time) quantum algorithms. This view leads to a nontrivial computational analysis whose upshot is that if Quantum Statistical Zero Knowledge is hard for quantum algorithms360, then the black hole will evaporate long before the observer can compute any paradoxical bit! In short, computational complexity offers one resolution of this paradox: time is too short for the experiment to take place, simply since the observer’s task is computationally hard361. This explanation (that in itself is conditional) is still debated with the others, but its computational spirit entered the discussion, and with it the understanding that viewing nature and observers as algorithms is illuminating! Understanding the processes in the interior of a black hole, which are subject to general relativity, is of course problematic almost by definition—there is no way to peek inside. Would it not be wonderful to deduce it from what we observe on its boundary? A remarkable proposal of Mal- dacena [Mal99] suggests something of that kind: a general method for accessing information about the behavior of particles governed by a quantum gravitational theory (like string theory) inside the “bulk” (or interior) of space-time region, from studying the dynamics of a quantum mechanical system on its boundary. This theory has become known as the AdS/CFT correspondence where AdS stands for “Anti de-Sitter” space362, and CFT for Conformal Field Theory363. Conformal field theories are completely accepted and computations of their evolving parameters are by now standard in some cases. Using these to infer various parameters inside the AdS universe (or indeed go the other way, use general relativity in AdS to bypass complex CFT computations364), one needs a “dictionary” that relates AdS to CFT quantities. Indeed, Maldacena provides an extensive such dictionary. While there is no proof of this duality, it has become an extremely useful tool in many areas of theoretical physics, and allows making predictions about the bulk behavior which may perhaps be tested. Now, we will focus on the Susskind puzzle, which asks for the analog of an AdS quantity called

359I did not make this up! 360No need to understand what that means, other that it is a computational assumption about the intractability of a natural problem, like P 6= NP. But I stress that this strange computational assumption, merging cryptography and quantum computing has made it to the consciousness of physicists. 361In the same way as in the section about Lord Kelvin’s calculations of the age of the universe could have killed Darwin’s evolution theory, if they were correct. 362To stress that the theory of gravity we employ happens on a negatively curved space, namely has a negative cosmological constant. As an aside, notice that this certainly is not the case in our universe, whose expansion is accelerating, and so has a positive cosmological constant; this does not stop physicists pursuing ﬁrst the full understanding of this “toy model”. 363Namely a quantum ﬁeld theory equipped with a strong symmetry called conformal invariance. Importantly, there is no gravity in CFT! 364In general these require quantum computation

290 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

wormhole length. This idea of “wormholes” goes back to Einstein and Rosen, and according to another exciting new theory of Maldacena and Susskind they are supposed to explain the nature of entanglement. Anyway, all we need to know is that in appropriate AdS universes the “length” of wormholes grows linearly with time. Susskind’s puzzle is to fill the dictionary with the analog quantity of the corresponding CFT. It is hard for any physicist to imagine any quantity in quantum evolution which scales linearly with time! But Susskind finds an answer by considering computational complexity. Discretize time and space in the given CFT, and you get a quantum circuit on some n qubits, which the evolution iterates at every step (say, with some fixed initial state ψ0, e.g. all zeroes). This iteration produces a sequence of quantum states, ψt after t steps. Susskind 365 proposes that the quantum circuit complexity of ψt in the CFT is the dictionary analog of the wormhole length after t steps in the AdS evolution! In other words, a fundamental, physical component of a theory of quantum gravity corresponds under this proposal to a computational parameter in CFT. Again, while still fresh and very debated, the view of processes in these theories as quantum circuits, and studying their computational complexity, is entering the discourse of theoretical physics.

20.4.5 Economics One of the great successes of ToC interactions with a “remote” discipline has been with economics, particularly with game theory. This field was born in the late 1940s with the celebrated magnum opus Theory of games and economic behavior of John von Neumann and Oscar Morgenstern, and with John Nash’s foundational papers on equilibria. During the following decades game theory has developed sophisticated and elaborate theories of markets and strategic behavior of rational agents in them. These theories manifestly aim to be predictive, and inform decision making of strategic entities (from von Neumann’s original motivation to play well the (frightening) cold war game with possible strategies including nuclear attacks, through the (potentially vicious) competition of different firms over market share, where strategies may be simply the prices of products, all the way to the personal and social interactions in numerous situations). In many theories and papers of the field, it was intuitively clear that real people or organizations, with computational limitations, must actually implement the suggested strategies. Indeed, some algorithms were proposed, but relatively little was done to formally investigate their performance, and more generally to integrate computational complexity into these models, partly since the relevant computational theory was missing. This void started filling in the 1980s, when a theory of algorithms and complexity was quite developed, and interest in ToC to apply it to economics grew. This work accellarated since the 1990s with the advent of the Internet, creating new markets in which processing time of participants became a primary concern. The interaction with ToC and the integration of the computational and algorithmic elements into economic theories and models encompasses many aspects of the field. It is lucky for me that an excellent collection of surveys appears in the book Algorithmic game theory [NRTV07], and so I will briefly recount below some of the major themes (by now, full fledged research areas) covered there; far more detail and missing references can be found in this book’s chapters. Plenty more research and collaboration has happened in the decade since this book’s publication, and I will conclude with one (very different) example of interaction between the fields. 365Namely the size of the smallest quantum circuit generating that state from the zero state.

291 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• Complexity of equilibria. Equilibria in a variety of strategic situations (games, markets) embody rational solution concepts: they guarantee each individual satisfaction with their payoff given the behavior of other parties, and so are sought as a notion of stability. Central theorems of game theory prove that equilibria exist in very general situations. But how to achieve them was rarely discussed. The pioneering work of Papadimitriou [Pap94] observes that the arguments used in such proofs are purely existential (e.g. topological fixed-point theorems), and that natural algorithms to compute equilibria require exponential time. He develops a complexity theory for economics and mathematical problems of this nature, namely where solutions are guaranteed by various existential principles. He raises the possibility that computing Nash equilibria is a complete problem for the class PPAD, namely as hard as finding a Brouwer fixed point. This was settled in the affirmative 15 years later [DGP09,CDT09], even for 2-player games, giving the first indication of hardness of Nash equilibria, possibly limiting its value as an economic solution concept366. Proving this result required the introduction of the family of graphical games into game theory in [KLS01]. The “need” for efficient equilibrium concepts which may salvage this hardness has led to approximate versions of Nash equilibria which do have near-polynomial time algorithms [LMM03]. Moreover, hardness results and algorithms were then extended to a variety of other equilibria, most notably the Arrow- Debreu market equilibria. Approximation algorithms for such problems connected this field with optimization, leading to proofs that in many “real-life” situations (restricting utilities, preferences, etc.), equilibria can be computed or approximated efficiently. • Price of anarchy. This is a completely different take on equilibria, one that could have been part of economic theory but somehow was not. Proposed in the seminal paper by Kout- soupias and Papadimitriou [KP99], the Price of anarchy is the ratio between the cost to society of a “distributed” solution, given by the worst equilibrium that individual (selfish and non-cooperating) agent strategies achieve, and the optimal “centralized” cost, attained by strategies assigned to them by a (benevolent and fully informative) entity. Numerous situations in which agents need to make decisions in utilizing shared resources (e.g. cars on roads, packets on the Internet), affect performance (and thus individual and societal cost), and raise the question how costly is this freedom of choice (“rational anarchy”). This paper has led to very surprising results showing that in many general situations the price of anarchy is far less than what might be expected. One major general result of this type is [RT02], establishing that this ratio is at most 4/3 for the traffic flow on any network of any size, in which delay on a link is a linear function of its congestion. This bound remarkably matches the tight example known for decades in economics as Braess’ paradox (showing that adding a link to a network can actually increase congestion), that is achieved on a 4-node network. Another example of a similarly surprising result, in its generality and in the bound on the price of anarchy it supplies, was discovered for the completely different setting of Walrasian equilibrium [BLNPL14]. We stress that while the questions of distributed versus centralized solution costs are non-algorithmic in nature, they, as well as their solutions, arise naturally from ToC methodology (here mainly the use of reductions and of approximation guarantees, neither common in classical game theory). This book exemplified the power of ToC methodology in other non algorithmic questions and answers that arise in mathematics. These important

366Further hardness results based on various (so far, nonstandard) cryptographic assumptions have recently been pursued (see e.g. [BPR15]), that heavily use the reductions and completeness foundations of [Pap94] and their subsequent development.

292 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

works have naturally led also to many algorithmic questions, again connecting with optimization, on-line algorithms and distributed computation, connected with research questions in game theory and generated new collaborations between the fields. • Mechanism design (sometimes called “inverse game theory”). A major goal of game theory is understanding the behavior of rational, strategic agents participating in games which are already pre-specified. Mechanism design is the field of game theory which asks the meta- question: how to specify (or engineer) these games, incentives and rules of behavior so as to force similarly rational, strategic agents to achieve certain global goals. Examples abound: governments setting up laws and distributing resources for various societal benefits, auctions aimed at selling items and maximizing profit, voting systems for best representations of public opinion, healthcare and other social systems balancing services and costs, etc. Many basic principles and theorems were discovered in this study, explaining e.g. how to elicit agents’ actions to have various properties as truthfulness, maximizing profit or some global social outcome. Again, the advent of the Internet has added numerous new applications for the design of mechanisms, which are also far more complex than many previously considered due to the potential huge number of participants, speed of action and the distributed nature of interaction (the market of on-line advertisements is a perfect example). Now algorithms are the agents, and their advantages and limitations must be taken into account. This has greatly enriched the theory of mechanism design in manifold ways. For example, the use of communication complexity and other tools allowed for hardness results limiting the power of mechanisms. For another, the view of (distributed) algorithms and protocols as executed by rational agents has added a completely new ingredient into algorithmic theory; its design should ensure behavior which makes it correct, efficient, fair, etc. when implemented by selfish rational players. The collaboration between ToC and game theory in this field is perhaps the most extensive, and is manifest in industry as well, as one can observe even restricting attention to the theory and practice of auctions for advertisements motivated by a multi-billion dollar search-engine advertising industry. • Cryptography and game theory. We mentioned above the negative news to economics following the computational complexity limitations on the discovery and implementation of desired strategies (e.g. in equilibria). On the other hand, plenty of positive news follows from cryptography on the implementation of strategies which seem impossible or hard to achieve in the (generally assumed) information theoretic environment of game theory. As one example, take the notion of correlated equilibrium of Aumann, which in contrast to Nash equilibrium is easy to compute, if all information about all players’ utilities is known to some central trusted player. This “unrealistic” assumption renders this notion almost useless in situations where no such trusted authority exists or players wish to protect their privacy, until you realize that the secure multi-party computation, which we elaborate on in the crypto chapter solves just that. Indeed, the papers [Yao86, GMW87, BOGW88] and their followers do so (in different settings), eliminating the need of a trusted party in any such situation, and making Auman’s solution concept (and many others) eminently realistic and useful! The many differences of axioms of both fields (in crypto, privacy is a goal, while in game theory it is often the means; in crypto, players may be honest or malicious while in game theory they are rational, etc. etc.) guarantee great synergy and collaboration as we integrate the point of view of one field into the other. Let me conclude with an example of interaction between the fields that tackles a completely

293 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

different, fundamental issue, that probes the assumption of transparency and efficiency of markets. Mountains of articles were written about the financial crisis of 2008, proposing numerous reasons and models for that colossal collapse. There is a general agreement that mis-pricing of financial derivatives (such as CDOs) played a central role, and there are debates about how to fight it. One paper which proposes a computational complexity perspective on this situation is the collaborative [ABBG10], Computational complexity and information asymmetry in financial products. In it, the authors propose a simple model which demonstrates how information asymmetry between buyer and seller, and hence the cost they assign to the same derivative, can be extremely high, even in a fully transparent market, and even if the buyer (or any inspector of the derivative contract) is extremely powerful computationally, e.g. a large bank, regulator or the government. Creating such artificial examples is easy for anyone who read the cryptography chapter, and indeed as explained there, this very asymmetry of information underlies all Internet security and e-commerce systems! The paper above constructs simple, natural CDOs, made up from mixing “normal” and “junk” assets, and shows that distinguishing those in which the mixture is random from those in which the mixture biases for “junk”, is a computationally difficult task under well-studied complexity assumptions. This paper has gotten some traction and reference in the economics literature (see e.g. the very different [CKL13,BCHP17] 367). I feel that the many financial models (e.g. like those of markets and risk in the papers above), invite possible revisions and extensions in light of computational complexity theory. Unlike game theory, the finance side of economics has had precious few collaborations with ToC so far, but I expect these to grow.

20.4.6 Social Science The advent of the Internet and the many types of social activities and networks it supports has opened up both a host of new problems for social scientists, as well as, for the first time, the ability to run social experiments on vast numbers of participants. This has created many new collaborations between computer and social scientists, which is enriching many aspects of social science and making it much more quantitative. Aside for the one (early) famous example below, which illustrates the nature of ToC influence, I will simply refer the reader to the excellent and extensive book Networks, crowds, and markets: Reasoning about a highly connected world [EK10]. This book itself is such a collaboration, and I note again that plenty more has happened in the seven years since its publication. The variety of topics of interaction between ToC and Social Science described there is staggering (especially given the short amount of time since interaction started), and we give just a taste. These topics highlight a major evolution within ToC of the study of distributed networks. We have devoted a chapter to some aspects of distributed systems in this book—most of this large field focuses on man-made design of networks and algorithms for them. The interaction with social science has expanded this field greatly! Among the many new aspects the book describes are the growth and change of different (physical, information, social) networks, the organic appearance and evolution of power structures within them (e.g. hubs, authorities, institutions), the nature of dynamic processes (gossip, influence, incentives, connectedness and others) on networks. Many of the network models include game-theoretic and economic aspects, when viewed as markets whose participants are strategic agents placed at the nodes. This connects the research here with that of the previous section. In all, the ease of getting real-world data on many of these aids the testing of new models, theories and algorithms. Of course, many other aspects and models of social interactions are not covered by the book [EK10], e.g. the work of

367Be cautious that the word “complexity” can mean many diﬀerent things in economics.

294 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

Chazelle on influence systems [Cha12, Cha15] mentioned above. Our example is Jon Kleinberg’s paper [Kle00], titled The small world phenomenon: an algorithmic perspective. We only sketch it here; the reader is encouraged to read its lucid, detailed exposition and references. This paper is a take on Stanley Milgram’s famous experiment on The small world problem, first described in [Mil67]. Following previous work pursuing the popular cliche Six degrees of separation, Milgram designed an experiment to test the connectivity and distance between pairs of people in the US by asking people to forward a letter from one to the other using only intermediaries who are on “first name basis” with each other. The required chains were typically indeed very short, and a sequence of analytical network models were suggested and analyzed which might at the same time explain social relations in society and support such short distance. But it took over 30 years until Kleinberg pointed out that there is another fundamental problem to be explained in Milgram’s experiment: even if short paths exist, why were such paths found by a purely local algorithm. Kleinberg went on to give a thorough answer. First, he proved that many networks models (including most suggested in past work) have an abundance of short paths, which no local algorithm will find! Next he proposed extended natural models, and identified the unique one in this class for which a local algorithm will succeed. This single work was key to the collaborations mentioned above, and to numerous follow-up works.

20.5 Conceptual contributions; or, algorithms and philosophy Let me move up another level of abstraction in the nature of ToC impact. We have seen some of the following important contributions in the book, but there are plenty more we didn’t! Alan Turing not only laid out the groundwork for the mathematical foundations of computer science and for the computer revolution which followed, but has also demonstrated the powerful light that computation can shine on fundamental concepts. His article, Computing machinery and intelligence [Tur50] takes on one of the most difficult and controversial notions, intelligence. With remarkable clarity and brevity, rare in arguments on such philosophically, socially and scientifi- cally charged concepts368, he proposes a completely fresh and original approach to defining and understanding it. Over the years, the theory of computation was presented with the need to understand, and thus also firstly to define, concepts and notions which have occupied intellectuals from many disciplines over centuries. This need arose sometimes from scientific or technological origins, and sometimes indeed from the philosophical inclinations of thinkers in the field. With the computational focus and language at heart, they gave birth to novel definitions of such concepts, breathing fresh ideas into arguments over their meaning and utility. This is far from saying that the computational lens is better than other views—it sometimes complements others. But rather, it points to the intellectual depth inherent in the field, and to the relevance of computation, and even more, computational complexity, at the philosophical level. I feel proud to belong to a field which has seriously taken on defining (sometimes re-defining, sometimes in several ways) and understanding such fundamental notions that include: collusion, coordination, conflict, entropy, equilibrium, evolution, fairness, game, induction, intelligence, interaction, knowledge, language, learning, ontology, prediction, privacy, process, proof, secret, simultaneity, strategy, synchrony, randomness, verification. It is worthwhile reading this list again, slowly. I find it quite remarkable to contrast the long history, volumes of text written and intellectual breadth the concepts in this list represent, with

368But typical to all of Turing’s arguments on many other issues, including his deﬁnition of a computer!

295 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

small and young such a field that has added so much to their understanding. Moreover, for many of these there was little or no expectation that the science of computing will need to deal with them, and that if it does, will find meaningful and illuminating ways to do so. It is only with hindsight that it all looks so natural now. This book discusses some of these notions, and when it does, I have tried to articulate the way computational complexity illuminates them, often borrowing directly from the very articulate people who originated these definitions. Scott Aaronson [Aar13b] notes that while some of us convey extremely well the philosophical implications of our work to our own community, we perhaps should broadcast more of it to the outside world, in particular to philosophers. His paper tries to do just that—explain the potentially important role that computational complexity can play in understanding some philosophical and scientific conundrums. This whole direction, abstracting the role of computation and complexity in the intellectual discourse probably deserves another book, far less technical and more accessible than this one. I will content myself here by concluding with two very high level philosophical issues, possibly meta- philosophical principles, that I did not discuss enough in the book. The first is subjectivity and the second is interaction. Again, neither is new, but armed with the computational complexity lens they inform and revise many of the notions above.

Subjectivity The first is the role of computational complexity in establishing subjectivity in the view of reality. Properties (including many of the notions listed above), were for centuries defined and treated as intrinsic, objective properties of objects, agents or interactions. Now they are treated by computational complexity theory as subjective, highly dependent on the observer! This should be reminiscent of Einstein’s special relativity, and its radical (at the time) predictions that different observers may see the same object have different lengths, or that may disagree on whether two events were simultaneous or not. Einstein derived such predictions by adding a single axiom: that the speed of light is constant. The axiom taken by computational complexity is that certain problems are intractable. This has no less radical consequences. A random event can be completely unpredictable by one observer, and predictable to another. A message can be clear to one receiver, and completely incomprehensible to all others. These consequences of the simple computational axiom underlie Internet security and E-commerce, as well as many other applications. What is more, differences in the computational powers of different observers (who may actually be participants in a certain activity) allow us to quantify “how much” of a given property is present from their point of view. For example we can quantify precisely, given the computational complexity of an observer, how predictable some event is, or how much knowledge it can glean about a secret message, or how accurately it can evaluate a complex economic commodity. In short, having different computational powers imply having different inference, analysis and reasoning powers, and sophisticated use of these limitations, together with appropriate versions of our computational axiom make this subjective view of reality the source of some of the most exciting and important applications of computing systems.

Interaction Interaction enhances many aspects in life. The importance of interaction for understanding easily follows by comparing a class in which students are allowed to ask questions, to a class in which they are not. Interaction of this nature underlies Turing’s “Imitation Game” which underlies his approach to intelligence. Simple examples also show that the cost (e.g. the amount of communication) of natural computational tasks between two parties can be greatly in bi-directional interaction versus uni-directional ones. The study of interaction in computational complexity has uncovered extremely surprising powers which were discussed in some chapters of this book. Here

296 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

are some examples. One major impact was on the central notion of proof. Classically, proofs are uni-directional communication from a prover to a verifier. Allowing bi-directional interactive proofs369 has led to a complete revision of what is the capability of proofs. First, more can be proved interactively: the “IP = PSPACE” theorem [Sha92] basically shows how a prover can convince a verifier of having a winning strategy in e.g. Chess, something unimaginable in classical proofs. Second, proofs can have paradoxical properties: the “NP in Zero-Knowledge” theorem [GMW91] basically shows that every statement which has a proof, has an interactive proof which is equally convincing, but reveals no new information to the verifier! Other fundamental discoveries extend results from the uni-directional to the interactive setting. Shannon’s famous result [Sha48] proves that uni-directional communication can be protected from constant noise-rate with only constant redundancy (via his error-correcting codes). The same result holds (via Schulman’s new ingenious codes [Sch92,Sch93]) for bi-directional communication, despite the adaptivity of such conversations. Let me conclude with a a higher level contribution, where the study of interaction (in the surprising context of information privacy), actually informs the scientific method itself. A key axiom of this method demands that a scientist decides the questions to ask about the data before she collects it. This forces a uni-directional communication with nature: first data is received or collected, and only then processed. Of course, findings lead to new questions and require new experiments and data acquisition. Scientists may be (indeed, some are) tempted, for efficiency reasons, to use existing data to answer the new questions, rather than collecting more data. Are the results of such adaptive use of data valid? As it happens, an interactive definition of differential privacy, and efficient algorithms for maintaining it, surprisingly inform the fragile validity of adaptive data analysis [DFH+15], showing that in certain cases the above temptation may be justified, and how! Such deep connections, which go far beyond the intended utility of the models and algorithms developed, further shows the depth of the very concept of computation.

20.6 Algorithms and Technology We now switch gears to discuss several aspects of the intense and continuous interaction between the theory of algorithm design and the industry of computing systems. Given its focus on computational complexity, this book has paid little attention to the major effort of the Theory of Computation, namely algorithm design. A major product of the theory of computation is the design and analysis of efficient algorithms for specific problems, and more fundamentally, the design of algorithmic techniques and paradigms for broad classes of computational tasks in a variety of models. Here I address a few issues related to algorithms, their design and impact, and interaction with technology. One word of caution: in much of the ensuing discussion the boundary between algorithms and technology is not always completely clear (as is the case between theory and practice, science and engineering, pure and applied math).

20.6.1 Algorithmic heroes The combination of algorithms and technology has provided computational power and its myriad applications to society in a way that has totally transformed it in just a few decades. No doubt, this trend will continue and accelerate. While both ingenious algorithms and remarkable technological advances played central roles in this revolution, it seems to me that the general public is not quite aware of the role algorithms play in enabling the applications they experience, and attribute it

369and incorporating randomness, error and complexity.

297 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

almost solely to technological advance. Of course, in many cases algorithmic and technological advance are intertwined, but this ignorance exists even when a single algorithm has enabled a whole industry, and moreover the essence of that algorithm can be explained to any undergraduate in a few pages or a few hours. In popular talks I give about algorithms and complexity I show two list of names, and ask the audience which of them is familiar. The first list has names like Johannes Gutenberg, Joseph Jacquard, Thomas Edison and James Watt. These were presented as cultural heroes when I was growing up for inventions that dramatically advanced society at the time: respectively the printing press, the weaving loom, the light bulb and the steam engine. Most general audiences recognize them and their inventions (although it is less so among young audiences). The second list I show has names like Edsger Dijkstra, Donald Knuth, John Tukey and Elwyn Berlekamp. Here I mostly draw blanks. I then show, just for impression, the few lines of pseudo-code for each of the respective algorithms: Shortest Paths, String Matching, Fast Fourier Transform and Reed-Solomon decoding that these algorithmic heroes and their collaborators developed, and others extended. I note that like the older inventions of physical devices mentioned, these tiny intellectual creations are extremely brilliant and efficient, but that their impact may be far larger. Demonstrating this I finally discuss (some of) the industries which have of variants these algorithms enabling them, respectively: automatic navigation, computational biology, medical imaging and all storage and communication devices. It seems to me that such stories are exciting and accessible school material even in middle school, and the theory community should have every incentive to bring it there. Of course, these are just examples and there are many others; prime examples of such algorithms include RSA, underlying most of E-commerce, and PageRank, underlying Internet search, and Back-Propagation, without which the “deep-networks” revolution in machine learning (that we will soon discuss) would be impossible. In these examples, some people may recognize the names of the algorithms (or the buzz surrounding them), but not necessarily their inventors. Finally, there are even more basic algorithmic principles and structures, for efficient data organization and access, including hashing, caching, sketching, heaps, trees, bags-of-words, among many others370, all gems underlying many algorithms and applications.

20.6.2 Algorithms and Moore’s Law Another point to discuss is the relative contribution of technology371 and algorithms to applications, especially in the future. Clearly, a computational application becomes available only if it is efficient enough to be useful to its users and profitable to its developers and manufacturers. How much more efficient can we make hardware and software? Focusing on the most basic resources whose efficiency is paramount, speed and size, clarifies how incredible the science and technology of hardware design has been. In what became known as Moore’s Law, Gordon Moore predicted in the 1960s the doubling of the number of components on integrated circuits every 18 months. Similar predictions were made regarding the increase in computational speed. Miraculously (at least to me), this exponential growth persisted at the predicted rate for half a century! But not anymore... Whether the recent slowing of Moore’s law is a sign of its imminent death, or it will stay with us for a while longer, technology has absolute physical limits. Components will never be smaller than atoms, and communication between them will never exceed the speed of light. At that point, and likely much earlier, the only source of efficiency will be the invention of better algorithms; which

370It is convenient for me to know that the reader can ﬁnd details on Wikipedia and other Internet sources. 371Here, in the sense of physical infrastructure of computing systems.

298 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

computational applications and products we will have available, and which we will not, will depend on algorithmic advances far more than on technological ones. Here, for numerous problems, the best time and space bounds we know seem far oﬀ from optimal, and there seems plenty of room for improvements!

20.6.3 Algorithmic gems vs. Deep Nets So, it is pretty certain that algorithms will rule the Earth, but which algorithms? The remarkable computing power which technology has already provided us (together with very important algorithmic advances!) has enabled a new breed of algorithms, which arise in machine learning. In short, algorithms as technological products. Tech and medical companies, as well as governments invest enormous funds and effort in these new algorithms, which I turn to describe (and are discussed more generally in Section 20.7.2). In stark contrast to the elegant, concise algorithmic gems mentioned above, which were man- made, many new algorithms simply “create themselves”, with relatively little intervention from humans, mainly through interaction with massive data. This contrast with “classic” algorithm design is heightened as these new algorithms are typically (and perhaps necessarily) gigantic, and very poorly understood by humans. I am referring of course to the “deep networks” (see [BGC15] for an extensive text on their uses in learning and optimization), a common name to heuristics modeled after networks of neurons372. I will conclude this section with a few remarks on these algorithms, and the challenges and questions they raise. Note that while machine learning was the topic of Chapter 17, it focuses on theoretical models and simple tasks, and not on the complex tasks and the heuristics mentioned below. These self-taught algorithms attempt to solve numerous problems which are often hard to formally define, such as finding “significant signals” in huge data sets that are often extremely noisy—be they financial, astrophysical, biological or the Internet. The structure one may want to extract/uncover may be clusters, correlations, geometric or numerical patterns etc. or completely unexpected ones. These may represent e.g. familiar faces or objects in pictures, groups of friends and interests in social media, market performance of companies in the buying and selling of stocks, effects of treatments or genetic defects in biological data and illuminating interactions of matter and energy in physical observations. This is no place to give a proper description of the deep nets and their training process. It suffices to say that today their size can get to millions of gates and wires between gates. Each connection has a strength parameter that the training process attempts to optimize. In short, training is a huge optimization problem with an ill-specified goal and numerous degrees of freedom in the heuristics driving the attempted optimization. This “black magic” works extremely well only in relatively few cases so far. But in a growing number of cases it greatly outperforms any human designed algorithm. It is extremely interesting when such a self-taught program can label by name the essential content of arbitrary pictures taken by humans, nearly as well as humans would. It is very impressive that another such program, after playing against itself a billion games of Go, can now beat the world’s best human players373. Great progress by such programs is made on human language understanding and translation, and perhaps their fastest growth is felt in “Data Science”, where these programs play ever more important roles in actual scientific discovery. Indeed, one

372There are many other types of heuristics, past or future, to which this discussion is relevant as well. However, deep nets seem to have become dominant in the past decade, so I’ll focus on them. 373This happened with Chess too, but there theory and human involvement were an essential part of the program design, whereas for Go such involvement seems to have been minimal.

299 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

wonders at what point they will be able to better articulate the new scientific laws uncovered and pursue their consequences like medical drugs and treatments, food and energy supply, etc. also without human help374. The main point I find fascinating and challenging on this front, and for which the theory of computation can and should contribute, is a theoretical understanding of such algorithms. This understanding should include ways to make their training more principled and efficient, and developing models and tools to assess their performance and output quality. A major challenge is to understand why and for what tasks are deep networks successful, and what are their limitations. Further, it is of crucial importance given their growing prevalence in systems humans crucially depend on, to explore how to make them fair (and what this means), how susceptible they are to adversarial data, and how to protect against it. Of course, the size and complexity of deep nets may put limits to how well they can be theoretically understood (much like massive creations of nature as the brain and other biological systems). Indeed, it is not unlikely that the theoretical study of deep nets (on which, unlike animals, experimentation is free from the Declaration of Helsinki guidelines) will help in better understanding biological systems and vice versa. Given our current ignorance (namely, gaps between upper and lower bounds) regarding many well posed important problems, I have no doubt that there is plenty more room for the discovery of algorithmic gems which we can easily understand, appreciate and use. To drive this point home, let me note in conclusions that no deep-nets would exist without a few great algorithmic gems embedded in practically all of them, including the extremely efficient back propagation and gradient descent

20.7 Some important challenges of ToC Even at a high level, there are just too many important challenges of ToC to list here, especially in the wide contexts of its connections to the practical world of computing, and the broad connections to the sciences. Also, quite a number of important conjectures appear in the diﬀerent chapters of this book. What I would like to single out here is four meta-challenges in the complexity theoretic core of ToC, which have many incarnations and formulations (some discussed in the book). These (naturally interrelated) challenges are certifying intractability, understanding heuristics, strengthening the foundations of cryptography and exploring the Church-Turing thesis.

20.7.1 Certifying intractability By far, the greatest challenge of computational theory (and a major challenge of mathematics), is to establish that some, indeed any, natural computational task is nontrivially difficult for a general computational model. This question has many incarnations, but the sad state of affairs is that even though almost every natural task we really care to perform seems exponentially difficult, we cannot establish even super-linear lower bounds (namely, that a given task is harder than just reading the input)! The P= 6 NP conjecture is of course the most popular manifestation of this challenge (e.g. proving a lower bound for some NP-complete problem like satisfiability of Boolean formulas or 3-coloring of maps). Similarly, establishing a non-trivial lower bound (if true) for even more basic (and practically burning) questions like integer multiplication or the discrete Fourier transform elude us as well. That for 80 years we had a formal mathematical model in which to prove such

374Feel free to extrapolate (as some have already done in intellectual discussions and in popular culture) on the many natural societal questions which arise given such abilities of machines.

300 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

lower bounds, and certainly great motivation for doing, demonstrates the difficulty of this major problem! Essentially the same sad state of affairs exists in questions of proof complexity: we know no nontrivial lower bounds on the length of e.g. Frege proofs of any propositional tautology; this quest is manifested by the N P= 6 coNP conjecture. Likewise, in arithmetic complexity, we know no nontrivial lower bounds on the number of arithmetic operations (sums and products) needed to compute natural polynomials like the Permanent; this quest is manifested by the VP 6= VNP conjecture. And the same holds for many other models and modes of computation; we can’t prove hardness! As discussed in Section5, we have “excuses” in the form of barrier results which give partial explanations of why current techniques fail to deliver nontrivial Boolean lower bounds. But, we do not really understand why we have not yet found techniques to bypass these barriers. Furthermore, in proof complexity and arithmetic complexity we don’t even have any excuses in the form of barrier results. In all models, the lower bounds can be expressed quite neatly in various forms as combinatorial and algebraic questions which do not betray any clear distinction from many other such questions that were resolved in these or other fields of mathematics (and in particular, the same lower bound questions for restricted models). So, understanding why proving nontrivial lower bounds is so difficult is one of the greatest challenges of the field, and probing this mystery abstractly may lead to progress on proving them. Of course, there are two explanations which must be mentioned, even though few (if any) believe them. First, that these conjectures are false, no lower bound exists, and everything is extremely easy to compute and prove. Second, that these conjectures are actually independent of mathematics, say of ZFC, and so can be true or false “as we please” from a provability standpoint, even though they have a truth value in the “real world”375. Ruling out the second option, without resolving these conjectures, is an extremely interesting direction as well. The simplest explanation (which is probably the correct one), is that proving lower bounds for general models is truly one of the deepest and most difficult mathematical problems we know. Thus, probably far more groundwork, on a variety of limited computational models, is needed to gain a true understanding of general computational models and their limitations. Of all challenges of the field, this is the one I care about most, and hope that it will continue to attract excellent researchers to develop the necessary structural theory and techniques towards such lower bounds. I am certain that such understanding will not only expose the limitations of computation, but also its full power.

20.7.2 Understanding heuristics We often get much more than we (theoretically) deserve. Many algorithms are known to behave extremely badly in some instances, but have excellent performance on “typical” ones. Let’s discuss some families of examples. • Some algorithms for diverse problems seem to perform far better (in time spent or output quality) than their theoretical analysis (if any) guarantees. Prototypical examples commonly given of such heuristics include SAT and TSP solvers on huge instances, the Simplex algorithm for linear programming. Of course, these heuristics are very clever, carefully optimized and ﬁne-tuned. 375A way this can happen is e.g. the existence of a polynomial-time algorithm for SAT, whose correctness is independent of ZFC.

301 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

• As discussed in more detail in Section 20.6.3 above, an explosion of heuristics arises from the new ability to train deep networks to solve learning, optimization and game playing problems. Also here there is a process of ﬁne tuning, but it is largely automated in that mysterious, self-teaching “training” process. In many (but certainly not all) problems motivated by a variety of applications, these heuristics outperform carefully designed algorithms, or human experts, on many natural data sets.

• Another family of examples, of a very different nature, is the following. Probabilistic algorithms are designed to work correctly (with high probability) assuming that the random coin tosses they use are perfect (namely, independent and unbiased). But they often seem to perform equally well when fed a sequence of bits generated in some arbitrary deterministic fashion, or taken from physical sources like Internet traffic or user keystrokes. This (possibly surprising) phenomena happens, for example, in numerous Monte-Carlo simulations used by physicists. • Finally, nature itself provides us with many processes that seem to quickly solve “hard problems”, like protein folding, formation of foams, market equilibria and coordinated action of swarms. Here of course we typically don’t really know nature’s algorithms, but may have models for them, which in many cases fail to predict or guarantee the observed (high quality) performance. The general but vague explanation to such phenomena is that the inputs to all these algorithms and processes come from certain sets or distributions (which nature or humanity generate), for which the given heuristic is far more efficient than for arbitrary inputs. The suitability of a heuristic to the “real-world” inputs it processes can have many reasons. In some cases algorithm designers managed to put their fingers on the actual (or related) input distribution and design the algorithm to be super efficient on such inputs (even though in general it may be slow), as happens for some TSP and SAT solvers. In some cases algorithms were designed to be natural and elegant, like the Simplex algorithm, where its superb performance on real-life linear programs was surprising and indeed lucky; our understanding of it is lacking despite various later attempts to explain it. In yet other cases algorithms evolved to suit their input distribution, as happens for many neural-nets and other (supervised and unsupervised) learning frameworks. Moreover in nature, where such learning and evolution abound, it is quite possible that in many settings both the algorithm and the inputs co-evolved to yield superior performance; e.g. perhaps proteins which survived are in particular those which fold easily by the algorithm in our cells. Understanding actual input distributions arising “in practice” for various computational tasks, and designing algorithms which handle them well (or explaining why certain heuristics do) is a very old and fundamental conundrum of the field. The many decades of algorithms research has provided theoretical models and frameworks which address this important issue from various viewpoints. General approaches include probabilistic analysis of algorithms [Kar76], semi-random models [FK01], smoothed analysis [ST04b] stable instances [BL12,BBG13], and input distributions with certain moment bounds [HS17, KS17] and many others376. Some of these approaches were developed, extended and applied significantly. Beyond such general approaches, which apply to wide families of algorithmic tasks, there are numerous papers which address specific tasks, targeting and taking advantage of their “natural” input distributions. This interaction between modeling inputs

376Including average-case analysis [Lev86] which focuses on hardness rather than easiness.

302 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

and algorithmic design is extremely important, and will hopefully lead to a better understanding of performance (and other behavioral properties) of such algorithms on “relevant” inputs. With the advent of machine learning algorithms that interact and improve with the data, there are more and more heuristics whose performance (which in many applications is extremely impressive) is hard to explain. These, and other existing heuristic mysteries present a great challenge of developing evaluation criteria for the actual performance and behavior of such algorithms, that we discussed already in Section 20.6.3 above. Possibly missing is a theory of benchmarking, which will allow comparing heuristics and suggest rational guidelines for choosing the many parameters of learning systems before setting them loose on the data. Certainly missing is a theory explaining the kinds of problems and kinds of data that e.g. deep-nets are good at solving, those which are not, and why. The need for such theory is not only theoretical! We will soon have to trust such algorithms (when they’ll replace humans e.g. in driving cars and in providing medical diagnoses and treatment), and trusting algorithms we do not understand is a very different matter than trusting algorithms we do understand. Most computer systems in existence are of the later type, but the balance is shifting. I believe that (beyond performance) theories modeling “social aspects” of program output should and will be developed, and some guarantees will have to be supplied by heuristics employed in the public sphere. These issues are already entering public policy and legal discourse (for one fascinating example, on the idea of delivering better justice by replacing judges by algorithms). It is clearly hard to expect a fully predictive theory of algorithmic design which would yield the ideal, instance optimal performance. On the other hand, the growing ease by which one can completely neglect any theoretical analysis and resign oneself to the output given by general heuristics such as deep networks can be dangerous. My personal feeling is that there is plenty more theoretical understanding to be gained on modeling classes of real-world data, designing general algorithmic techniques to efficiently and accurately solve them and evaluating the performance of heuristics. This challenge is central to the field, and to society. I expect that the growing interactions with the natural sciences will add both new questions and new ideas to this study.

20.7.3 Resting cryptography on stronger foundations Cryptography is discussed at length in Chapter 18. Crypto is by far the most extensive and repeatedly surprising study of remarkable consequences of intractability assumptions. Furthermore, these consequences (and thus, the assumptions needed for them) form the current foundations of computer privacy and security and electronic commerce, which are used by individuals, companies, armies and governments. One would imagine that society would test these foundations and prepare for potential fragility at least as well as it does for, say, nuclear reactors, earthquakes and other potential sources of colossal disasters. However, as discussed in Section 18.11, while most of cryptography requires the existence of trap-door functions, we have precious few candidates for these, of which integer factoring is still the main one (other important candidates are based on elliptic curves, lattices and noisy linear equations). Moreover, short of the fact that these problems were not found to be easily solvable yet, we have no shred of evidence that any of them is really difficult. For example, an efficient algorithm for any of these few problems will not imply efficient algorithms for a large collection of many other problems which are believed hard, and will not imply the collapse of any complexity classes. I find this state of affairs quite worrisome, and feel that far more effort should be devoted

303 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

to the challenge of finding more secure foundations for cryptography. The world has too much to lose if these foundations collapse. And it should be stressed that cryptographic research is thriving, mainly expanding the frontier of applications and consequences of even stronger (so, less believable) intractability assumptions than trap-door functions377. Naturally, applications are often first discovered under strong or specific assumptions, which are later weakened. Still, caution is necessary, certainly when resting the security of actual systems on shaky assumptions. Of course, part of this state of affairs, namely of having few reliable, useful assumptions, is not for lack of trying, and this challenge is indeed formidable. Given the first challenge of proving super- linear lower bounds for, well, anything, we can’t expect yet super-polynomial lower bounds for e.g. factoring. One natural direction is simply developing more candidates for trap-door functions, in case others break. Here the difficulty seems to be the (often algebraic) structure these problems seem to “demand”. Another is developing reductions between trap-door functions, to show that efficient algorithms for any of them have non-trivial consequences. Here again the rigid structure seems to resist reductions. Finally, resting cryptography on more believable intractability, preferably P= 6 NP (or at least its average-case version) runs into impossibility results against black-box use of such assumptions. Barak [Bar01] was the first to go beyond such black-box use; much more has followed. But it seems that further development of non-black-box crypto techniques (in which there definitely is exciting activity) is essential to this challenge.

20.7.4 Exploring physical reality vs. computational complexity The celebrated Church-Turing thesis always struck me as an amazingly bold challenge. After all, it basically asserts that everything computable is computable by a Turing machine. where “everything” is any well defined function with discrete input and output domains. This thesis challenges anyone, scientists most prominently, to come up with such a well defined computational task, which can be performed somehow in the real world (including the ability to prepare the input and read-off the output), with any physical means whatsoever, but which cannot be computed by the Turing machine (one of the simplest physical devices imaginable). Still, in the 80 years that have passed, no one has come forth with a serious response to this challenge. Soon after complexity theory was developed in the 1970s, people quickly extended this thesis to the far bolder thesis that it holds even if we restrict ourselves to efficient computation. This is sometimes called the “strong” or “feasible” Church-Turing thesis, and essentially states everything efficiently computable is efficiently computable by a Turing machine. Here “efficient” is usually equated with “polynomial” (although one can adopt more stringent efficiency measures). This means that physical resources expended in the computational process, like energy and mass, as well as time and space, which are used in the computational process are allowed to grow only polynomially with the input size. This thesis, together with the P 6= NP conjecture, presents a seemingly much more tangible challenge: simply find a natural process that can solve some NP-complete problems with polynomial resources. And indeed, here came numerous suggestions, many (but certainly not all) explained and discussed in Aaronson’s beautiful survey [Aar05]. As we discussed in Section 3.10, many of such

377The choice of proper cryptographic assumptions is itself a ﬁeld of study in cryptography, discussed e.g in [GK16] and its references.

304 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

proposals strengthen the case for adding P 6= NP (and more generally computational complexity considerations) as a guiding principle for modeling natural phenomena378. However, here I want to turn around the challenge provided by the strong Church-Turing thesis, and consider it not only as a challenge to scientists to either refute it or use computational complexity in modeling natural processes, but rather as a challenge to complexity theorists, to computationally abstract and model those (potential) gifts of nature which may eventually be used to enhance our laptops. Rising to this challenge (or rather challenges, as they arise from all walks of nature) has already been extremely important to foundational questions about efficient computation and algorithms, as well as to practice. Two of the main examples of exploring such gifts occupied several chapters in this book: the gift of randomness and the gift of “quantumness”. I’ll start with these, and then mention a few others that are less developed. First, nature seems to provide us with plenty of unpredictable phenomena, leading to the extremely important (theoretically and practically) theories of probabilistic algorithms, probabilistic proofs, pseudo-randomness and randomness extraction. The first two theories postulate access to perfect randomness, namely a sequence of unbiased, independent coin tosses, for the benefit of enhancing computational power. These extremely rich theories are discussed at length respectively in Chapter7 and 10. The last two theories explore relaxing (in different ways) this strong postulate (of having access to perfect randomness), which may be violated in the real world. One, (described in Section 7.2, explores having no access to randomness at all (and replaces it with a universally believed hardness assumption for “generating unpredictability”). The other (described in Chap- ter9) assumes we can only access very weak random sources, e.g. sequences of highly biased and correlated bits (and explains how to enhance their quality). Now, practical use of “random” sequences in computer programs, e.g. in Monte Carlo simulations for weather prediction and nuclear interactions predates all these theories, and moreover it seemed that in many cases it did not matter how arbitrary (including deterministic!) was the “random” source that was used to yield “useful” results. But of course, there were no guarantees in these situations, nor understanding when such sources “worked” and when they did not. The two theories above provide a formal basis to the study of randomness requirements of probabilistic algorithms, showing them provably applicable in settings way beyond the original requirement of perfect randomness. These theories justified and guided the choices of “random” sources to be used, identified sources which should not be used, and found efficient means to enhance weak ones. The de-randomization results (especially BPP = P) which follow from these theories impact the Church-Turing thesis directly: they justify replacing deterministic Turing machines with probabilistic ones (that err with small probability), as a legitimate definition of what efficient computation is379. Beyond all of that, as we discuss in the book [Wig17], the abstract study of randomness has been incredibly useful to the theory and practice of computation (and mathematics) in many unexpected ways, way beyond the original intent. Next, nature actually seems to provide us with quantum mechanical phenomena, of which spit- ting out perfectly random coin tosses is among the simplest powers. Indeed, this power seems to promise a possibility of efficiently manipulating (some) exponentially long pieces of information! This promise led to the theoretical study of using such quantum phenomena in computation, formulation of the quantum mechanical Turing machine and the study of its power and limits (we have devoted Chapter 11 to this exciting research area). Here theory is far from fully developed.

378Which in many of these proposals also bring out the need to understand the actual inputs fed to these “heuristics of nature” in the sense discussed in the “heuristics challenge” above. 379This does not belittle the importance of using randomness nonetheless, when it gives polynomial speed-ups.

305 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

While we have formal universal models and equivalences between them, important understanding of certain quantum (decoherence) error correction, quantum cryptographic protocols and numerous interactions with physicists, we have only precious few problems such a quantum computer can solve efficiently that a classical (probabilistic) one cannot380. Fortunately or not, these few problems include integer factoring and discrete logarithms, so this model undermines the current foundations of most cryptographic security systems. Of course here (unlike with probabilistic computing) theory predated practice, and the algorithmic potential has led to the many, extremely challenging (and expensive) practical projects of building a quantum computer; literally attempting to add this quantum enhancement to our laptop and revising yet again our understanding of what an efficient Turing machine is. The jury is out on which of the win-win outcomes will materialize: either we will have such quantum laptops (significantly enhancing our computational abilities), or we will discover a fundamental gap in our models of nature which prevent their existence (and with it, hopefully revise them and formulate better ones). But beyond motivating and assisting the practical project, the developed theories of quantum computing, proofs, advice, learning, games and more have been extremely illuminating to the classical theory of computation in many unexpected ways (leading to lower bounds, quantum reductions between classical problems, no-signaling PCPs for delegation of computation, certification of randomness and many others). Here, unlike with probabilistic computation, the belief is that quantum computation does add power to Turing machines (namely that BQP 6= BPP). I find the discovery of more problems in the gap, as well as reasons why despite it N P 6⊆ BQP as well, to be an extremely challenging direction for computational complexity theory. What else can we add to our laptops, or networks, or other algorithms, which will enhance the notion of what can be efficiently computed? There are many other gifts of nature, possibly more specific than the two above, which were already turned into computational models and paradigms whose algorithmic power and limits are explored, and many others being pursued. As discussed, I find that besides the natural scientific interest in such (and many other) models for the benefit of understanding nature, their purely theoretical pursuit as computational models will be beneficial for broader understanding of computation itself, and perhaps to the discovery of new algorithmic techniques, possibly leading to the creation of new computational devices and systems. Many examples of natural phenomena with such potential are mentioned in this chapter on the connections of ToC to the sciences above. I thus look forward to the discovery of the power, limits and relationships emanating from the study of such computational settings, formalized perhaps e.g. as DNA machines, nano machines, selfish networks, natural algorithms (among many others), enriching both the practice of computing as well as its theory. Some of these may lead to classes like nano-P, selfish-P, etc., and possible probabilistic, quantum, non-deterministic, space-bounded, non-uniform, . . . variants, and new connections to previously studied models that will deepen our understanding of computation.

20.8 K-12 Education This is a huge subject, so the discussion here is quite superficial and scattered, and this is aggravated by the lack of proper references (which may well exist). It can be regarded perhaps as a short wish- list, and a call-to-arms for the participation of ToC professionals in this effort. The theory of computation has so much to offer in making the education curriculum (at all levels) of every person so much better, richer, more valuable and fun that it would take a separate

380Beyond the basic problem of simulating quantum systems.

306 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

book to discuss this. Of course, I am not original here, and there are plenty of thoughts and projects underway (with articles describing them) which suggest such efforts of integrating “computational thinking” into classrooms at various ages in various ways. As usual, even very good ideas have to eventually be implemented. As with other subjects, besides deciding what and how to teach kids, the most nontrivial task is figuring out how to train teachers to successfully deliver this material, with enthusiasm, to students. To make better decisions on both principles and implementation, I strongly hope that members of our community, who are inclined to do so, will be involved in these developments—this challenge is at least as important as exploring the scientific challenges of our field. Below I list a small sample of truths I wish all kids would learn (at the appropriate age) in a way that will excite them and make them (via appropriate examples and demonstrations) remember them forever, no matter what life interests they end up pursuing. I believe these capture examples of the kind of minimal knowledge and understanding about computation that all educated people should possess, in the same sense that we expect them to possess elementary knowledge and understanding about other topics such as the basic sciences, history, social systems, etc. • Turing, like Einstein, was one of the giants of 20th century science. His influence on technology and society was far greater. • Computers cannot do everything. Indeed, there are basic, desirable computational tasks they can never accomplish. This is an absolute truth (a mathematical theorem), just like Pythagoras’ theorem. • What computers can do relies on the discovery of clever, efficient algorithms. One such algorithm can create a new industry, or predict and prevent an epidemic. The great discoverers of algorithms sit in the same hall of fame with great inventors, like Gutenberg, Edison, Pasteur,. . . • Theories of nature should be predictive. Prediction is an algorithm! Predicting the weather, or natural disasters before they happen requires these algorithms to be very efficient, faster than nature! • Most math problems don’t have only one right answer (with all others “wrong”). As in life, many mathematical tasks have solutions of different quality. Finding any solution is a good start, and trying to improve it is even better (this is discussed more below). • The place value (e.g. decimal or binary) system that we all use to represent numbers was invented, and survived for millennia, only since it afforded extremely efficient storage and algorithms for performing arithmetic. Compare it to the unary system, or Roman numerals, ... • The method we learn to multiply numbers in grade school is firstly, an algorithm, and moreover, it is not the fastest algorithm known. There is a much faster one, which is still slower than the algorithm we have for adding numbers. It is a great intellectual mystery, with great practical implications, whether multiplication is inherently harder than addition. • The world economy assumes computational hardness (at this point in time, this is the assumption that “inverting multiplication”– finding the prime factors of a large number – is an impossibly hard problem). Moreover, world economy may collapse if this (or related) computational assumptions are false.

307 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

A bigger issue, in which I believe that ToC education has much to offer is math education in elementary and high school. A lot has been written on the subject, and I will be brief on this point. For a more elaborate text, see this article by Fellows [Fel91], who has also invested much effort in developing classroom material for elementary schools and moreover has experimented with delivering it. A recognized major malady of math education is the focus on arithmetic and algebra, with repetition ad nauseum of numerous, equivalent, boring numerical exercises to which the answer can be either right or wrong. In contrast, algorithmic problems on discrete objects offer, from kindergarten age on, an enormous variety of problems on e.g. games, puzzles, mazes, which offer solutions of varied qualities and properties. For example, in optimization problems, every solution may be “correct”, but their cost differ. Or, many different algorithms, strategies and methods may solve a problem, but the amount of time or other resources they expand differ. In such problems, solutions of students invite the challenge can you do better? that is so much more constructive than wrong! Such problems also far better relate to the basic human experience all students feel resolving life conflicts, from scheduling their activities to maximizing something (interest, pleasure, their parents’ satisfaction, ...), spending their allowance or playing better chess or soccer. Such problems also better relate to the view expanded on above of natural processes (themselves algorithms typically solving optimization problems), which should be highlighted in science courses, making a connection to math rather than through equations alone. Problems in which solutions of different qualities exist, and the quest to find better and better ones, allow students deeper understanding and, I believe, much more fun. Moreover, such problems expose math much better as a modeling science, which allows precise formulation of such life and science situations, as well as aspects like chance, uncertainty, partial information and adversity. I feel that incorporating these ideas into math education, first for teachers and then for students is very important (and I am not underestimating the difficulty of this task). This material should be part of every young person’s knowledge in this information age, but at the same time teaching it can also help transform the sad, negative attitude of many generations towards the very subject of mathematics. Repeating myself, these ideas are not original and indeed are attempted in many places - I am simply calling here for more participation of ToC professionals, to whom this way of thinking is so natural, in developing the materials and implementation details for this important endeavor.

20.9 The ToC community I believe that the remarkable success of the ﬁeld, partly summarized above, was not purely due to the intellectual content of ToC and the raw talents of its researchers, but also the way the ToC community organized and built itself. This section is devoted to this process and character as I have experienced it, through very active participation in all relevant activities, in all stages of my career. I allow myself generalities when the exceptions I know of are rare, fully realizing that my view is biased and that I tend to idealize. Since the 1960s much activity of ToC has been centered at and propelled by two yearly conferences, FOCS (Foundations Of Computer Science) and STOC (Symposium on the Theory Of Computing)381. Taking place in the Fall and Spring respectively, these forums became the meet-

381These conferences generally take place in North America, and I have attended most of these since 1980. Other conferences which encompass most areas in ToC, with some biases or diﬀerent geographic locations were later added with a similar broad appeal, including ICALP, MFCS, SODA, ITCS, and what I say below is relevant to them as

308 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

ing place (and the beating heart) of the whole community, a good fraction of which came to hear accounts of the most exciting developments in the field in the last 6 months. These presentations are determined by a program committee, which has no time to referee submissions, but rather to evaluate their novelty and impact on progress in the field. These have two effects. One is in the committee meetings themselves: 20 or so experts, of different research areas, opinions (and different ages!) meet periodically to discuss the submissions and make tough selection decisions, help clarify contributions and shape directions. Second is the periodical meetings of a significant chunk of the ToC community, including many graduate students, at these conferences. The constant intellectual excitement about the challenges supplied in abundance by the field, and undoubtedly the person- alities of its elders, have created a culture whose characteristics I’d like to list (and idealize). They undoubtedly play an important role in the success of the field so far, and it will be great to preserve and strengthen many of these as the growth and diversification of the field continue (which may be nontrivial). Needless to say, many of them are part of other academic disciplines, but I find their combination in ToC quite unique.

• Level of discourse. The need to convince a program committee, many members of which are not experts on your submission, has brought submissions to include long introductions with high level motivation for the research described. Further, it has impacted the inclusion of intuitive explanations of technical developments. Restricted to being short, submissions therefore focus on ideas and concepts, which eased their propagation to non-experts. The exact same effect has amplified in the lectures. As many members of the audience are non-experts, motivation and intuition occupy significant parts of the short lectures. Thus papers and lectures help highlight ideas and concepts, which can easily be understood by many. Moreover, this level of discussion allowed the use and generalization of ideas and concepts developed in one context, possibly for a particular problem or application in completely different ones. This common high-level language, and the frequent exchange of the most recent important findings, has undoubtedly been responsible for the fast progress of the field. I believe that this too has an impact on the way ToC faculty teach their courses and write their books and surveys, putting stress on highlighting motivation, ideas, concepts and intuition before and beyond technical definitions and proofs. • Openness and evolution. The horn of plenty which computation is, the diversity of its sources and manifestations, together with the varied interests of its researchers, has generated completely novel models, questions and research directions. These new interests competed for attention of the community with making progress on existing and more established directions and open problems. It fell on the same bodies, program committees of these conferences, to become the arbiters of the balance of new and old, and which parts of each, to select for acceptance and presentations. These frequent discussions and debates, among researchers of different ages and tastes, made more valuable by the common language above, not only inform the actual participants about the broad activities in the fields and their colleagues’ opinions on them, but has created a forum which had repeatedly to make tough choices on which of these trends will be visible and in which proportions. Looking back at the historical evolution of trends and directions one can observe a great agility to pursue and investigate, as well as great openness to embrace and advertise, completely new ideas, models, connections and problems (emanating from technological, scientific or purely abstract considerations). This well.

309 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

has created a wonderful dynamic, giving birth to many new research directions that were incubated at these forums. Many of these (e.g. most chapter titles in this book are perfect examples) grew suﬃciently large to establish their own specialized conferences and communi- ties, often operating in the same style. Of course, some other research directions have shrunk, died out or merged with others.

• A common core. Despite this dynamic of topics entering and leaving this spotlight, central themes, mainly in the core algorithmic and complexity theoretic areas of the field, maintained a long term presence even if they grew as above. Essential to the discovery of many fundamental principles (of broad applicability across ToC) came from studying purely mathematical, seemingly “un-motivated” models and problems, which seemed “impractical” or “un-natural” generalizations of existing ones, or just came out of left field. In short, following internal logic and aesthetics of the field, common in mathematics but much less so in application-driven areas. The openness of the community to such ideas paid back big time as exemplified in many chapters, and kept re-establishing the value of the core. Another key factor that made possible, as well as strengthened, the core was maintaining the level and style of discourse described above, despite the tremendous expansion in diversity of areas covered. Naturally, this diversity necessitated many changes in the structure of the conferences and the sizes of program committees, but still allowed the exchange of ideas, concepts and methods across and between these very differently motivated and structured research directions. Moreover, the rate, fluidity and quality of this exchange has clarified to what extent ToC is a cohesive field, and how important it is to have a core and an infrastructure to utilize it. In many cases this flow of ideas, methods and results was extremely natural, whereas in many others it required remarkable ingenuity, and of course knowledge of what was going on in other areas. In a lecture on the value of such knowledge I dubbed this phenomenon depth through breadth, the value and strength of which I find unique to our field. Some of the commonality of these many threads is captured in the methodology section above. • Community and attraction of talent. Challenging and important long term goals, a rich tapestry of concepts, ideas and tools with exciting progress in connecting and expanding them, the building of theories to gradually access such understanding, and many other intellectual facets of a scientific field are necessary prerequisites to continuously attract young talent inmthe field , who will further the work. And indeed, the theory of computation has all that and more, as this chapter and indeed the whole book exposit. But I would argue that the social and educational structure of the field makes it even more attractive for young talent to enter, stay, grow and hopefully discover, educate and lead. I have already explained how the level of discourse makes it easy and inviting to newcomers, especially those exposed to it in undergrad and grad schools, but also for researchers of different fields who are interested. Another important aspect is the “democracy” and social welcoming of the field, which generally considers raw ideas and not the seniority of those generating them. One of my formative experiences, as a first year graduate student, was being introduced in the FOCS conference of 1980 to Richard Karp, the most eminent leader of the field. It was “Dick, this is Avi, Avi, this is Dick”, which followed by five or ten minutes in which Karp, with genuine interest, explored what areas of theory I like and might be pursuing. I quickly learned that no introductions were even needed, and that leaders of the field were equally accessible when you come to them with a problem or idea. I believe that this is the experience felt to this day by newcomers to the field, which has created a community of much collegiality, collaboration and friendship.

310 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

This atmosphere persists despite the natural and much welcome competitiveness and drive of ToC researchers.

Critique After these many positive aspects, I think it makes sense to mention a couple of issues where I feel that our community has behaved sub-optimally, in the hope that these will improve over time. They are all related, and probably stem from a single root cause, namely an internal focus on the intellectual problems of the field, neglecting to some extent a necessary investment in the external spheres in which we live and function. By far the most significant neglect is in communicating with the outside world about ToC achievements, both their intellectual contents and their practical impact. Of course, some ToC members invested in popular lectures, surveys and books for the general CS community, the general scientific community and even the public over the years. But I fear that what was achieved by them is far smaller than could have been achieved with much more (well justified) effort. There are many ways to demonstrate the general low level of understanding, acknowledgement and appreciation of the amazing body of work created by ToC, outside the field. This state of affairs could easily improve, as many of our discoveries has such appealing conceptual contents, and so are easy to relate to almost any audience. In short, I feel that the field should make it a priority, and hope that much more will be done on this important front. One way which makes it easier to communicate a topic, especially for the general public, but also for people outside one’s domain, is having an evocative vocabulary to describe central notions and results. By far the field that excels over all others in this domain is physics. Of course, it starts with a huge natural advantage over most other fields, as their objects of study have aroused our curiosity and fascination from a very early age, like the stars, rainbows, ocean waves, flying birds and so many more. But even for objects of study to which we have no direct access they pick intriguing and captivating names like “big bang”, “black holes”, “dark matter”, “super novae”, etc., and call some elementary particles “strange” and “charm”. In contrast, not only does ToC start with no one having any computational or algorithmic experience in a formative age, we call our main concepts by boring, inexplicable acronyms like P, NP, BPP, SC, NC... (and these are just a few of the most famous animals in the “complexity zoo”382). There are numerous other choices made which I believe could be much better, and perhaps the best example is “complexity” itself (even in the phrase “computational complexity”), which is far too general and is constantly confused with other uses and meanings of this word. Much better phrases for what we are actually studying would have been “computational efficiency” and “computational intractability”. Of course, some choices are excellent in being both meaningful and intriguing, like the concepts “zero knowledge proofs”, “Monte Carlo algorithms”, “randomness extractors”, “price of anarchy” and the problems “dining philosophers”, “Byzantine generals”, “perfect matching” and “maximum clique”. I would argue that bad naming choices hinder our internal education of undergraduate and graduate ToC students, not only our ability to communicate our work outside the field! While some of the bad choices are too engrained and thus possibly too late to change, I feel that being conscious of this issue may give birth to better names of new concepts, and inspire inventive names for old concepts which the community can adopt in popular lectures (where using professional jargon is not necessary).

382A website of most complexity classes maintained by Scott Aaronson.

311 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

20.10 Conclusions Scientific disciplines are born (and transformed) in different ways; volumes have been written on the subject. In the case of ToC it is remarkably easy to determine the precise moment of birth. It happened in a singular event, following an age-old process. Computation, in its manifold forms, has been a subject of inquiry since the dawn of man, simply since the efficient utilization of resources is a second (or first) nature to people (and, to all life forms, and indeed to inanimate matter subject to the laws of physics). But this inquiry was missing a formalism that would make it precise. This formalism was supplied in 1936 by Turing’s seminal paper, which gave us the Turing machine model. It struck gold, finally enabling the creation of a theory! Computation revealed itself as a bottomless goldmine, and what was already uncovered by ToC research stands as one of the greatest achievements in scientific history. In the sections above I discussed many facets of the Theory of Computation, especially its past and potential future contributions to human inquiry and to society. Its pure academic, mathematical pursuit probes some of the deepest intellectual questions asked by man. And as a bonus, it is of fundamental importance to most other sciences, and to technology and human life. In short, this chapter, and the book containing it, present the clear case that ToC is an independent, important academic discipline. I feel that this view should be the basis of any discussion (internal or external) regarding the field and its future. This position of ToC in the intellectual arena comes with great responsibility. To continue and develop both internally and in the expanding and dynamic collaborations with other disciplines, I believe that the ToC community needs to grow, and such growth presents new challenges. Some of these will be adequately met by the spirit and social culture of this young field, which I hope will be preserved. Others have to do with the changing nature of the field and its increased diversity, and I feel require significant effort concentrated on education and on cohesion. Let me elaborate a bit. ToC is in the beginning phase of what I expect will be a long-lasting endeavor. Like other centuries-old disciplines such as mathematics, physics, biology and philosophy, ToC may change form and focus many times in the future. I find that the current period is definitely one of such change, possibly a phase transition, due to the explosion of connections of the field to other scientific disciplines, and the ever growing demands for theory from the even larger explosion of CS&E, generating new technologies and applications of computing systems at an unbelievable pace. These present enormous challenges, as both the nature and size of ToC are changing. I find a couple of (related) predictions inevitable, and each calls for action on the part of the ToC community. First, as the need for computational modeling and algorithm design throughout the sciences and industry expands, many more professionals will have to be trained in its principles and methodology. These will become prerequisite in most undergraduate education, and I strongly feel that ToC must play an active role in the design of these courses and curricula. Second, computational theory research and researchers will become integral parts of disciplines outside CS, and at the same time ToC research itself (which started as a pure math pursuit of computer system motivated problems) will need to adapt, and adopt experimental aspects of scientific and social theories studying the real world. This great expansion and diversity, not only of research topics but also of methods and culture, is certainly a blessing, and indeed part of the calling of ToC. But it also means that maintaining a viable, central core of the field will become much harder. Hard as it is, however, I strongly believe that preserving such a core, which will allow the flow and exchange of fundamental ideas, techniques and insights about computation relevant across disciplines, will be at least as important

312 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

as it was in the past. Conversely, I fear that fragmentation of the field can lose this important advantage! The challenge of preserving the cohesion of ToC is certainly nontrivial, and will require thoughtful reorganization and adaptation. Besides creating physical and on-line forums to maintain this cohesion and exchange of ideas, I find that it can greatly benefit from administrative changes in undergraduate education. Specifically, the creation of majors, certificates and other undergraduate programs dedicated to ToC is natural. There is a wealth of material regarding foundations and connections of the field, and it is ripe for creating a highly rich and challenging curricula. The value, to both academia and industry, of a student graduating with this knowledge and understanding of theory, is extremely high. Looking further, I feel that given the growing intellectual centrality of ToC to so many academic departments, (and even though CS will probably remain the strongest connection), it may become natural and beneficial, for universities and the field itself, to create separate ToC departments; this will reflect and reinforce both the field’s independence and its centrality to others. Building and maintaining the necessary structures, like those suggested above, to preserve cohesion of ToC, can only exist if the community is confident in its independence, value and mission. Namely, it can happen only if ToC members fully appreciate the meaning, importance, scope and impact of past achievements, and the even greater potential of future ones. These conceptual messages should be an essential part of the education we provide and propagate to our students (and each other), well beyond the technical know-how. Such a foundation will hopefully facilitate further constructive discussion on the organization of the field, which I find so important for its future.

313 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

References

[AA11] Scott Aaronson and Alex Arkhipov. The computational complexity of linear optics. In Proceedings of the forty-third annual ACM symposium on Theory of computing, pages 333–342. ACM, 2011. 135 [Aar03] Scott Aaronson. Is “P versus NP” formally independent? Bulletin of the EATCS, 81:109–136, 2003. 70

[Aar05] Scott Aaronson. Guest column: NP-complete problems and physical reality. ACM Sigact News, 36(1):30–52, 2005. 47, 303 [Aar13a] S. Aaronson. Quantum Computing since Democritus. Cambridge University Press, 2013. 132

[Aar13b] Scott Aaronson. Why philosophers should care about computational complexity. Computability: Turing, G¨odel,Church, and Beyond, pages 261–328, 2013. 295 [Aar16] Scott Aaronson. The complexity of quantum states and transformations: From quantum money to black holes. arXiv preprint arXiv:1607.05256, 2016. 288, 289 [Aar17] Scott Aaronson. P=?NP. In Electronic Colloquium on Computational Complexity (ECCC), volume TR17-004, 2017. 37 [AAVL11] D. Aharonov, I. Arad, U. Vazirani, and Z. Landau. The detectability lemma and its applications to quantum hamiltonian complexity. New Journal of Physics, 13(11):113043, 2011. 138, 140

[AB03] M. Agrawal and S. Biswas. Primality and identity testing via Chinese remaindering. Journal of the ACM, 50(4):429–443, 2003. 106, 157 [AB09] S. Arora and B. Barak. Computational complexity: a modern approach. Cambridge University Press, 2009. 14 [ABBG10] Sanjeev Arora, Boaz Barak, Markus Brunnermeier, and Rong Ge. Computational complexity and information asymmetry in ﬁnancial products. In ICS, pages 49–65, 2010. 293 [ABF+08] Misha Alekhnovich, Mark Braverman, Vitaly Feldman, Adam R Klivans, and Toniann Pitassi. The complexity of properly learning simple concept classes. Journal of Computer and System Sciences, 74(1):16–34, 2008. 231

[ABL02] Sanjeev Arora, BélaBollobás,and LászlóLovász. Proving integrality gaps without knowing the linear program. In Foundations of Computer Science, 2002. Proceedings. The 43rd Annual IEEE Symposium on, pages 313–322. IEEE, 2002. 272 [ABND+87] Hagit Attiya, Amotz Bar-Noy, Danny Dolev, Daphne Koller, David Peleg, and Radi- ger Reischuk. Achievable cases in an asynchronous environment. In Foundations of Computer Science, 1987., 28th Annual Symposium on, pages 337–346. IEEE, 1987. 254, 260

314 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[ABO97] D. Aharonov and M. Ben-Or. Fault-tolerant quantum computation with constant error. In Proceedings of the twenty-ninth annual ACM symposium on Theory of computing, pages 176–188. ACM, 1997. 136 [ABOE10] D. Aharonov, M. Ben-Or, and E. Eban. Interactive proofs for quantum computation. In Proceedings of Innovations of Computer Science (ICS 2010), China, pages 453– 469, 2010. 141 [ABOEM17] Dorit Aharonov, Michael Ben-Or, Elad Eban, and Urmila Mahadev. Interactive proofs for quantum computations. arXiv preprint arXiv:1704.04487, 2017. 141 [AC11] Hagit Attiya and Armando Castañeda. A non-topological proof for the impossibility of k-set agreement. In Symposium on Self-Stabilizing Systems, pages 108–119. Springer, 2011. 261 [ACORT11] D. Achlioptas, A. Coja-Oghlan, and F. Ricci-Tersenghi. On the solution-space geometry of random constraint satisfaction problems. Random Structures & Algorithms, 38(3):251–268, 2011. 166 [AD97] M. Ajtai and C. Dwork. A public-key cryptosystem with worst-case/average-case equivalence. In Proceedings of the twenty-ninth annual ACM symposium on Theory of computing, pages 284–293. ACM, 1997. 59, 171 [Adl78] L. Adleman. Two theorems about random polynomial time. Proceedings of 19th IEEE Symposium on Foundations of Computer Science, pages 75–83, 1978. 87, 88 [Adl94] Leonard M Adleman. Molecular computation of solutions to combinatorial problems. Nature, 369:40, 1994. 284 [AEH75] Eralp A. Akkoyunlu, Kattamuri Ekanadham, and R. V. Huber. Some constraints and tradeoffs in the design of network communications. In ACM SIGOPS Operating Systems Review, volume 9, pages 67–74. ACM, 1975. 258 [AFG14] Andris Ambainis, Yuval Filmus, and Fran¸coisLe Gall. Fast matrix multiplication: Limitations of the laser method. arXiv preprint arXiv:1411.5414, 2014. 149 [AFR06] James Aspnes, Faith Ellen Fich, and Eric Ruppert. Relationships between broadcast and shared memory in reliable anonymous distributed systems. Distributed Comput- ing, 18(3):209–219, 2006. 254 [AGHP92] N. Alon, O. Goldreich, J. H˚astad,and R. Peralta. Simple constructions of almost k- wise independent random variables. Random Structures & Algorithms, 3(3):289–304, 1992. Addendum: Random Structures and Algorithms 4 (1993), 119–120. 104 [AH89] Kenneth I. Appel and Wolfgang Haken. Every planar map is four colorable, volume 98. American mathematical society Providence, 1989. 23 [AH92] L. M. Adleman and M. A. Huang. Primality testing and abelian varieties over finite fields, volume 1512. Springer, 1992. 157 [AH17] Eric Allender and Shuichi Hirahara. New insights on the (non)-hardness of circuit minimization and related problems. TR17-073, 2017. 52

315 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[AHK12] Sanjeev Arora, Elad Hazan, and Satyen Kale. The multiplicative weights update method: a meta-algorithm and applications. Theory of Computing, 8(1):121–164, 2012. 115, 209, 273 [AHT06] I. Agol, J. Hass, and W. P. Thurston. The computational complexity of knot genus and spanning area. Trans. Amer. Math. Sci., pages 3821–3850, 2006. 43

[Ajt83] M. Ajtai. σ1-formulae on finite structures. Ann. Pure Appl. Logic, 24(1):1–48, 1983. 66, 69 [Ajt96] M. Ajtai. Generating hard instances of lattice problems. In Proceedings of the twenty- eighth annual ACM symposium on Theory of computing, pages 99–108. ACM, 1996. 59, 171 [AK09] Noga Alon and Bo’az Klartag. Economical toric spines via cheeger’s inequality. Jour- nal of Topology and Analysis, 1(02):101–111, 2009. 169 [AKN98] D. Aharonov, A. Kitaev, and N. Nisan. Quantum circuits with mixed states. In Proceedings of the thirtieth annual ACM symposium on Theory of computing, pages 20–30. ACM, 1998. 132 [AKS83] MiklósAjtai, JánosKomlós,and Endre Szemerédi.An O(n log n) sorting network. In Proceedings of the fifteenth annual ACM symposium on Theory of computing, pages 1–9. ACM, 1983. 69 [AKS87] M. Ajtai, J. Komlós,and E. Szemerédi. Deterministic simulation in LOGSPACE. In Proceedings of the nineteenth annual ACM symposium on Theory of computing, pages 132–140. ACM, 1987. 122 [AKS04] M. Agrawal, N. Kayal, and N. Saxena. Primes is in P . Ann. of Math., 160(2):781–793, 2004. 28, 39, 98, 106, 157 [AL88] Dana Angluin and Philip Laird. Learning from noisy examples. Machine Learning, 2(4):343–370, 1988. 221 [AL11] Gilad Asharov and Yehuda Lindell. A full proof of the BGW protocol for perfectly secure multiparty computation. Journal of Cryptology, pages 1–94, 2011. 247 [Ald83] D. J. Aldous. Random walks on finite groups and rapidly mixing Markov chains. In Séminaire de ProbabilitésXVII 1981/82, pages 243–297. Springer, 1983. 165 [Ald90] D. J. Aldous. The random walk construction of uniform spanning trees and uniform labelled trees. SIAM Journal on Discrete Mathematics, 3(4):450–465, 1990. 165 [All17] Eric Allender. The complexity of complexity. In Computability and Complexity, pages 79–94. Springer, 2017. 52 [ALM+98] S. Arora, C. Lund, R. Motwani, M. Sudan, and M. Szegedy. Proof verification and the hardness of approximation problems. J. ACM, 45(3):501–555, 1998. 130, 272 [ALN08] Sanjeev Arora, James Lee, and Assaf Naor. Euclidean distortion and the sparsest cut. Journal of the American Mathematical Society, 21(1):1–21, 2008. 162

316 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Alo86] N. Alon. Eigenvalues and expanders. Combinatorica, 6(2):83–96, 1986. 110, 111 [ALW01] Noga Alon, Alexander Lubotzky, and Avi Wigderson. Semi-direct product in groups and zig-zag product in graphs: connections and applications. In Foundations of Computer Science, 2001. Proceedings. 42nd IEEE Symposium on, pages 630–637. IEEE, 2001. 112

[AM75] L. Adleman and K. Manders. Computational complexity of decision problems for polynomials. Proceedings of 16th IEEE Symposium on Foundations of Computer Science, IEEE Comput. Soc. Press, Los Alamitos, CA, pages 169–177, 1975. 43

[AM85] N. Alon and V. D. Milman. λ1, isoperimetric inequalities for graphs, and superconcentrators. Journal of Combinatorial Theory, Series B, 38(1):73–88, 1985. 110

[AM88] Noga Alon and Wolfgang Maass. Meanders and their applications in lower bounds arguments. Journal of Computer and System Sciences, 37(2):118–129, 1988. 190 [AMPS13] Ahmed Almheiri, Donald Marolf, Joseph Polchinski, and James Sully. Black holes: complementarity or ﬁrewalls? Journal of High Energy Physics, 2013(2):62, 2013. 289

[AMS96] Noga Alon, Yossi Matias, and Mario Szegedy. The space complexity of approximating the frequency moments. In Proceedings of the twenty-eighth annual ACM symposium on Theory of computing, pages 20–29. ACM, 1996. 180 [And87] A. E. Andreev. About one method of obtaining more than quadratic eﬀective lower bounds of complexity of PI-schemes, 1987. 66

[Ank52] N. C. Ankeny. The least quadratic non residue. Annals of mathematics, pages 65–72, 1952. 106 [ANS10] Bharat Adsul, Suresh Nayak, and KV Subrahmanyam. A geometric approach to the kronecker problem ii: Invariants of matrices for simultaneous left-right actions. Manuscript, available in http://www. cmi. ac. in/kv/ANS10. pdf, 2010. 175 [APR83] L. Adleman, C. Pomerance, and R. S. Rumely. On distinguishing prime numbers from composite numbers. Annals of Mathematics, pages 173–206, 1983. 157 [AR87] N. Alon and Boppana R. The monotone circuit complexity of Boolean functions. Combinatorica, 7(1):1–22, 1987. 68

[AR01] Michael Alekhnovich and Alexander Razborov. Resolution is not automatizable unless W[P] is tractable. In focs, page 210. IEEE, 2001. 83 [AR05] D. Aharonov and O. Regev. Lattice problems in NP ∩ coNP. Journal of the ACM (JACM), 52(5):749–765, 2005. 52

[Arı09] Erdal Arıkan. Channel polarization: A method for constructing capacity-achieving codes for symmetric binary-input memoryless channels. IEEE Transactions on In- formation Theory, 55(7):3051–3073, 2009. 203

317 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Aro94] S. Arora. Probabilistic checking of proofs and the hardness of approximation problems. PhD thesis, UC Berkeley, 1994. Revised version in http://eccc.hpi-web.de/ eccc-local/ECCC-Books/sanjeev_book_readme.html. 130 [Art27] E. Artin. Uber¨ die zerlegung deﬁniter funktionen in quadrate. In Abhandlungen aus dem mathematischen Seminar der Universit¨atHamburg, volume 5, pages 100–115. Springer, 1927. 80 [AS83] Dana Angluin and Carl H Smith. Inductive inference: Theory and methods. ACM Computing Surveys (CSUR), 15(3):237–269, 1983. 218 [AS98] Sanjeev Arora and Shmuel Safra. Probabilistic checking of proofs: A new characterization of NP. Journal of the ACM (JACM), 45(1):70–122, 1998. 272 [AS00] N. Alon and J. Spencer. The Probabilistic Method. Wiley-Intersci. Ser. Discrete Math. Optim. John Wiley, 2 edition, 2000. 69, 100, 123 [AS03] Sanjeev Arora and Madhu Sudan. Improved low-degree testing and its applications. Combinatorica, 23(3):365–426, 2003. 274 [AS10] V. Arvind and S. Srinivasan. On the hardness of the noncommutative determinant. In Proceedings of the 42nd ACM symposium on Theory of computing, pages 677–686. ACM, 2010. 155 [Asp99] A. Aspect. Bell’s inequality test: more ideal than ever. Nature, 398(6724):189–190, 1999. 140 [Asp03] James Aspnes. Randomized protocols for asynchronous consensus. Distributed Com- puting, 16(2-3):165–175, 2003. 259 [AV08] M. Agrawal and V. Vinay. Arithmetic circuits: A chasm at depth four. In Proceedings- Annual Symposium on Foundations of Computer Science, pages 67–75. IEEE, 2008. 154 [AvDK+08] D. Aharonov, W. van Dam, J. Kempe, Z. Landau, S. Lloyd, and O. Regev. Adiabatic quantum computation is equivalent to standard quantum computation. SIAM review, 50(4):755–787, 2008. 139 [AW04] Hagit Attiya and Jennifer Welch. Distributed computing: fundamentals, simulations, and advanced topics, volume 19. John Wiley & Sons, 2004. 252, 254 [AW09] S. Aaronson and A. Wigderson. Algebrization: A new barrier in complexity theory. ACM Transactions on Computation Theory (TOCT), 1(1):2, 2009. 62, 70 [AZGMS14] Zeyuan Allen-Zhu, Rati Gelashvili, Silvio Micali, and Nir Shavit. Sparse sign- consistent johnson–lindenstrauss matrices: Compression with neuroscience-based constraints. Proceedings of the National Academy of Sciences, 111(47):16872–16876, 2014. 287 [AZH16] Zeyuan Allen-Zhu and Elad Hazan. Variance reduction for faster non-convex optimization. In International Conference on Machine Learning, pages 699–707, 2016. 273

318 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[AZO14] Zeyuan Allen-Zhu and Lorenzo Orecchia. Linear coupling: An ultimate uniﬁcation of gradient and mirror descent. arXiv preprint arXiv:1407.1537, 2014. 273 [Bab85] L. Babai. Trading group theory for randomness. Proceedings of the 17th annual ACM Symposium on Theory of Computing, ACM Press, New York, pages 421–429, 1985. 124, 125

[Bab90] L. Babai. E-mail and the unexpected power of interaction. Proceedings of the 5th Annual Conference on Structure in Complexity Theory, IEEE Comput. Soc. Press, Los Alamitos, CA, pages 30–44, 1990. 125 [Bab91] L. Babai. Local expansion of vertex-transitive graphs and random generation in ﬁnite groups. In STOC, volume 91, pages 164–174. Citeseer, 1991. 164

[Bab15] L´aszl´o Babai. Graph isomorphism in quasipolynomial time. arXiv preprint arXiv:1512.03547, 2015. 30, 52, 163 [Bar86] David A. Barrington. Bounded-width polynomial-size branching programs recognize exactly those languages in NC1. In Proceedings of the eighteenth annual ACM symposium on Theory of computing, pages 1–5. ACM, 1986. 184, 280 [Bar01] Boaz Barak. How to go beyond the black-box simulation barrier. In Foundations of Computer Science, 2001. Proceedings. 42nd IEEE Symposium on, pages 106–115. IEEE, 2001. 240, 303 [Bar16] Alexander Barvinok. Combinatorics and Complexity of Partition Functions. Springer, 2016. 276 [BB84] C. H. Bennett and G. Brassard. Quantum cryptography: Public key distribution and coin tossing. In Proceedings of IEEE International Conference on Computers, Systems and Signal Processing, volume 175. New York, 1984. 136

[BBC+93] C. H. Bennett, G. Brassard, C. Cr´epeau, R. Jozsa, A. Peres, and W. K. Wootters. Teleporting an unknown quantum state via dual classical and Einstein-Podolsky- Rosen channels. Physical Review Letters, 70(13):1895, 1993. 136 [BBCR13] Boaz Barak, Mark Braverman, Xi Chen, and Anup Rao. How to compress interactive communication. SIAM Journal on Computing, 42(3):1327–1363, 2013. 199, 200, 201, 202 [BBG13] Maria-Florina Balcan, Avrim Blum, and Anupam Gupta. Clustering under approximation stability. Journal of the ACM (JACM), 60(2):8, 2013. 55, 301 [BC06] Mark Braverman and Stephen Cook. Computing over the reals: Foundations for scientiﬁc computing. Notices of the AMS, 53(3):318–329, 2006. 25

[BCE+95] Paul Beame, Stephen Cook, Jeﬀ Edmonds, Russell Impagliazzo, and Toniann Pitassi. The relative complexity of NP search problems. In Proceedings of the twenty-seventh annual ACM symposium on Theory of computing, pages 303–314. ACM, 1995. 50

319 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[BCHP17] Sylvain Benoit, Jean-Edouard Colliard, Christophe Hurlin, and Christophe P´erignon. Where the risks lie: A survey on systemic risk. Review of Finance, 21(1):109–152, 2017. 293 [BCS10] P. B¨urgisser,M. Clausen, and M. A. Shokrollahi. Algebraic Complexity Theory. Springer Publishing Company, Incorporated, 2010. 144

[BCSS98] L. Blum, F. Cucker, M. Shub, and S. Smale. Complexity and Real Computation. Springer-Verlag, 1998. 25 [BDBK+94] Shai Ben-David, Allan Borodin, Richard Karp, Gabor Tardos, and Avi Wigderson. On the power of randomization in on-line algorithms. Algorithmica, 11(1):2–14, 1994. 207, 209 [BDWY13] B. Barak, Z. Dvir, A. Wigderson, and A. Yehudayoﬀ. Fractional Sylvester–Gallai theorems. Proceedings of the National Academy of Sciences, 110(48):19213–19219, 2013. 159 [Bea94] Paul Beame. A switching lemma primer. Technical report, Technical Report UW- CSE-95-07-01, Department of Computer Science and Engineering, University of Washington, 1994. 66 [Bea97] Robert Beals. Quantum computation of fourier transforms over symmetric groups. In Proceedings of the twenty-ninth annual ACM symposium on Theory of computing, pages 48–53. ACM, 1997. 135

[Bec91] J´ozsefBeck. An algorithmic approach to the lov´aszlocal lemma. i. Random Structures & Algorithms, 2(4):343–365, 1991. 166, 276 [BEHW90] Anselm Blumer, Andrzej Ehrenfeucht, David Haussler, and Manfred K. Warmuth. Occam’s razor. Readings in machine learning, pages 201–204, 1990. 226, 227

[Bel64] John S. Bell. On the Einstein-Podolsky-Rosen paradox. Physics, 1(3):195–200, 1964. 140 [Ben80] Paul Benioﬀ. The computer as a physical system: A microscopic quantum mechanical Hamiltonian model of computers as represented by Turing machines. Journal of Statistical Physics, 22(5):563–591, 1980. 132, 281

[Ber67] E. R. Berlekamp. Factoring polynomials over ﬁnite ﬁelds. Bell System Technical Journal, 46(8):1853–1859, 1967. 88, 158 [Ber84] S. J. Berkowitz. On computing the determinant in small parallel time using a small number of processors. Information processing letters, 18(3):147–150, 1984. 150

[Bes19] A. Besicovitch. Sur deux questions d’integrabilit´edes fonctions. J. Soc. Phys. Math., 2:105–123, 1919. 158 [BEY05] Allan Borodin and Ran El-Yaniv. Online computation and competitive analysis. Cam- bridge University Press, 2005. 206

320 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[BF28] Max Born and Vladimir Fock. Beweis des adiabatensatzes. Zeitschrift f¨urPhysik, 51(3-4):165–180, 1928. 139 [BF90] D. Beaver and J. Feigenbaum. Hiding instances in multioracle queries. Proceeding STACS, pages 37–48, 1990. 126

[BFK09] Anne Broadbent, Joseph Fitzsimons, and Elham Kasheﬁ. Universal blind quantum computation. In Foundations of Computer Science, 2009. FOCS’09. 50th Annual IEEE Symposium on, pages 517–526. IEEE, 2009. 141 [BFK10] A. Broadbent, J. Fitzsimons, and E. Kasheﬁ. QMIP= MIP*. arXiv preprint arXiv:1004.1130, 2010. 140

[BFL91] LászlóBabai, Lance Fortnow, and Carsten Lund. Non-deterministic exponential time has two-prover interactive protocols. Computational complexity, 1(1):3–40, 1991. 127, 274 [BFS86] LászlóBabai, Peter Frankl, and Janos Simon. Complexity classes in communication complexity theory. In Foundations of Computer Science, 1986., 27th Annual Symposium on, pages 337–347. IEEE, 1986. 186, 188 [BG93] Elizabeth Borowsky and Eli Gafni. Generalized FLP impossibility result for t-resilient asynchronous computations. In Proceedings of the twenty-fifth annual ACM symposium on Theory of computing, pages 91–100. ACM, 1993. 261

[BG08] J. Bourgain and A. Gamburd. Uniform expansion bounds for Cayley graphs of SL2(Fp). Annals of Mathematics, pages 625–642, 2008. 111, 112 [BG10] Jean Bourgain and Alexander Gamburd. Spectral gaps in SU(d). Comptes Rendus Mathematique, 348(11):609–611, 2010. 112 [BGBD+04] Yaakov Benenson, Binyamin Gil, Uri Ben-Dor, Rivka Adar, and Ehud Shapiro. An autonomous molecular computer for logical control of gene expression. Nature, 429(6990):423–429, 2004. 284 [BGC15] Yoshua Bengio, Ian J Goodfellow, and Aaron Courville. Deep learning. An MIT Press book in preparation. Draft chapters available at http: // www. iro. umontreal. ca/ ~ bengioy/ dlbook , 2015. 214, 298 [BGGT13] Emmanuel Breuillard, Ben Green, Robert Guralnick, and Terence Tao. Expansion in ﬁnite simple groups of Lie type. arXiv preprint arXiv:1309.1975, 2013. 112 [BGI+01] Boaz Barak, Oded Goldreich, Rusell Impagliazzo, Steven Rudich, Amit Sahai, Salil Vadhan, and Ke Yang. On the (im)possibility of obfuscating programs. In Annual International Cryptology Conference, pages 1–18. Springer, 2001. 249

[BGS75] T. Baker, J. Gill, and R. Solovay. Relativizations of the P =? NP question. SIAM J. Comput., 4:431–442, 1975. 61 [BGS10] Jean Bourgain, Alex Gamburd, and Peter Sarnak. Aﬃne linear sieve, expanders, and sum-product. Inventiones mathematicae, 179(3):559–644, 2010. 112

321 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[BGT10] Emmanuel Breuillard, Ben Green, and Terence Tao. Suzuki groups as expanders. arXiv preprint arXiv:1005.0782, 2010. 112 [BGW99] L. Babai, A. G´al,and A. Wigderson. Superpolynomial lower bounds for monotone span programs. Combinatorica, 19(3):301–319, 1999. 104

[BH14] Sergey Bravyi and Matthew Hastings. On complexity of the quantum Ising model. arXiv preprint arXiv:1410.0703, 2014. 138 [BIP16] Peter B¨urgisser,Christian Ikenmeyer, and Greta Panova. No occurrence obstructions in geometric complexity theory. arXiv preprint arXiv:1604.06431, 2016. 153, 174 [BIW06] B. Barak, R. Impagliazzo, and A. Wigderson. Extracting randomness using few independent sources. SIAM Journal on Computing, 36(4):1095–1118, 2006. 159 [BJ01] A. A. Bulatov and P. Jeavons. Algebraic structures in combinatorial problems. Int. J. of Algebra and Computing, 2001. 53 [BJSW16] Anne Broadbent, Zhengfeng Ji, Fang Song, and John Watrous. Zero-knowledge proof systems for QMA. In Foundations of Computer Science (FOCS), 2016 IEEE 57th Annual Symposium on, pages 31–40. IEEE, 2016. 140 [BK89] M. Blum and S. Kannan. Designing programs that check their work. Proceedings of the Twenty First Annual ACM Symposium on Theory of Computing, pages 86–97, 1989. 126

[BKI+96] P. Beame, J. Krajicek, R. Impagliazzo, T. Pitassi, and P. Pudlak. Lower bounds for Hilbert’s Nullstellensatz and propositional proofs. Proceedings of the London Math Society, 73(3):1–26, 1996. 76 [BKN14] Zvika Brakerski, Yael Tauman Kalai, and Moni Naor. Fast interactive coding against adversarial noise. Journal of the ACM (JACM), 61(6):35, 2014. 204

[BKPS02] Paul Beame, Richard Karp, Toniann Pitassi, and Michael Saks. The efficiency of resolution and Davis–Putnam procedures. SIAM Journal on Computing, 31(4):1048– 1075, 2002. 83 [BKS99] I. Benjamini, G. Kalai, and O. Schramm. Noise sensitivity of Boolean functions and applications to percolation. Publications Mathématiquesde l’Institut des Hautes Etudes´ Scientifiques, 90(1):5–43, 1999. 167 [BKS+05] Boaz Barak, Guy Kindler, Ronen Shaltiel, Benny Sudakov, and Avi Wigderson. Sim- ulating independence: New constructions of condensers, Ramsey graphs, dispersers, and extractors. In Proceedings of the thirty-seventh annual ACM symposium on The- ory of computing, pages 1–10. ACM, 2005. 103

[BKT04] J. Bourgain, N. Katz, and T. Tao. A sum-product estimate in ﬁnite ﬁelds, and applications. Geometric & Functional Analysis GAFA, 14(1):27–57, 2004. 159 [BL06] Yonatan Bilu and Nathan Linial. Lifts, discrepancy and nearly optimal spectral gap. Combinatorica, 26(5):495–519, 2006. 112, 160

322 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[BL08] Peter A Brooksbank and Eugene M Luks. Testing isomorphism of modules. Journal of Algebra, 320(11):4020–4029, 2008. 175 [BL12] Yonatan Bilu and Nathan Linial. Are stable instances easy? Combinatorics, Proba- bility and Computing, 21(05):643–660, 2012. 55, 301

[BLG12] Henrik Bäärnhielm and Charles R Leedham-Green. The product replacement prospector. Journal of Symbolic Computation, 47(1):64–75, 2012. 164 [BLMW11] P. Bürgisser,J. M. Landsberg, L. Manivel, and J. Weyman. An overview of mathematical issues arising in the geometric complexity theory approach to VP6=VNP. SIAM Journal on Computing, 40(4):1179–1209, 2011. 153

[BLNPL14] Moshe Babaioff, Brendan Lucier, Noam Nisan, and Renato Paes Leme. On the efficiency of the walrasian mechanism. In Proceedings of the fifteenth ACM conference on Economics and computation, pages 783–800. ACM, 2014. 291 [BLR93] M. Blum, M. Luby, and R. Rubinfeld. Self-testing/correcting with applications to numerical problems. Journal of Computer and System Sciences, 47(3):549–595, 1993. 126, 274 [Blu86] M. Blum. Independent unbiased coin flips from a correlated biased source—a finite state Markov chain. Combinatorica, 6(2):97–108, 1986. 118 [Blu94] Avrim Blum. Relevant examples and relevant features: Thoughts from computational learning theory. In AAAI Fall Symposium on ?Relevance, volume 5, 1994. 231 [BM84] M. Blum and S. Micali. How to generate chryptographically secure sequences of pseudorandom bits. SIAM J. Comput., 13:850–864, 1984. 94, 239 [BO83] Michael Ben-Or. Another advantage of free choice: Completely asynchronous agreement protocols. In Proceedings of the second annual ACM symposium on Principles of distributed computing, pages 27–30. ACM, 1983. 259 [BO85] M. Ben-Or. Private communication, 1985. 146 [BOC92] Michael Ben-Or and Richard Cleve. Computing algebraic formulas using a constant number of registers. SIAM Journal on Computing, 21(1):54–58, 1992. 184

[BOGKW89] M. Ben-Or, S. Goldwasser, J. Kilian, and A. Wigderson. Efficient identification schemes using two prover interactive proofs. Advances in Cryptography (CRYPTO 89), Lecture Notes in Comp, 435:498–506, 1989. 125, 127, 130, 142 [BOGW88] Michael Ben-Or, Shafi Goldwasser, and Avi Wigderson. Completeness theorems for non-cryptographic fault-tolerant distributed computation. In Proceedings of the twentieth annual ACM symposium on Theory of computing, pages 1–10. ACM, 1988. 247, 292 [BOL85] M. Ben-Or and N. Linial. Collective coin flipping, robust voting schemes and min- ima of Banzhaf values. In Foundations of Computer Science, 1985., 26th Annual Symposium on, pages 408–416. IEEE, 1985. 167

323 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Bor85] C. Borell. Geometric bounds on the Ornstein-Uhlenbeck velocity process. Zeitschrift f¨urWahrscheinlichkeitstheorie und Verwandte Gebiete, 70(1):1–13, 1985. 168 [Bou85] J. Bourgain. On Lipschitz embedding of ﬁnite metric spaces in Hilbert space. Israel Journal of Mathematics, 52(1-2):46–52, 1985. 161

[BP98] P. Beame and T. Pitassi. Propositional proof complexity: Past, present, and future. Bull. EATCS, 65:66–89, 1998. 71 [BPR97] Maria Bonet, Toniann Pitassi, and Ran Raz. Lower bounds for cutting planes proofs with small coeﬃcients. The Journal of Symbolic Logic, 62(03):708–728, 1997. 84 [BPR15] Nir Bitansky, Omer Paneth, and Alon Rosen. On the cryptographic hardness of ﬁnding a nash equilibrium. In Foundations of Computer Science (FOCS), 2015 IEEE 56th Annual Symposium on, pages 1480–1498. IEEE, 2015. 291 [BR14] Mark Braverman and Anup Rao. Information equals amortized communication. IEEE Transactions on Information Theory, 60(10):6058–6069, 2014. 200, 201, 202

[Bra84] Gabriel Bracha. An asynchronous [(n − 1)/3]-resilient consensus protocol. In Pro- ceedings of the third annual ACM symposium on Principles of distributed computing, pages 154–162. ACM, 1984. 259 [Bra15] Mark Braverman. Interactive information complexity. SIAM Journal on Computing, 44(6):1698–1739, 2015. 202

[Bro11] Luitzen Egbertus Jan Brouwer. Uber¨ abbildung von mannigfaltigkeiten. Mathema- tische Annalen, 71(1):97–115, 1911. 262 [Bro89] A. Broder. Generating random spanning trees. In Foundations of Computer Science, 1989., 30th Annual Symposium on, pages 442–447. IEEE, 1989. 165

[Bro15] Anne Broadbent. Delegating private quantum computations. Canadian Journal of Physics, 93(999):1–6, 2015. 141 [BRS11] Martin Biely, Peter Robinson, and Ulrich Schmid. Easy impossibility proofs for k-set agreement in message passing systems. In International Conference On Principles Of Distributed Systems, pages 299–312. Springer, 2011. 261

[BRSW12] B. Barak, A. Rao, R. Shaltiel, and A. Wigderson. 2-source dispersers for no(1) entropy, and Ramsey graphs beating the Frankl-Wilson construction. Annals of Mathematics, 176(3):1483–1543, 2012. 103 [BRW05] Robert D Barish, Paul WK Rothemund, and Erik Winfree. Two computational primitives for algorithmic self-assembly: Copying and counting. Nano letters, 5(12):2586– 2592, 2005. 284 [BS83] W. Baur and V. Strassen. The complexity of partial derivatives. Theoretical computer science, 22(3):317–330, 1983. 147

324 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[BS84] L. Babai and E. Szemerédi. On the complexity of matrix group problems I. In Foundations of Computer Science, 1984. 25th Annual Symposium on, pages 229–240. IEEE, 1984. 32, 163 [BS97] E. Bach and J. Shallit. Algorithmic number theory. Efficient algorithms, vol. 1, 1997. 158 [BS14] B. Barak and D. Steurer. Sum-of-squares proofs and the quest toward optimal algorithms. In Proc of ICM, 2014. 81, 272 [BSS14] J. Batson, D. A. Spielman, and N. Srivastava. Twice-Ramanujan sparsifiers. SIAM Review, 56(2):315–334, 2014. 160 [BSSV03] Paul Beame, Michael Saks, Xiaodong Sun, and Erik Vee. Time-space trade-off lower bounds for randomized computation of decision problems. Journal of the ACM (JACM), 50(2):154–195, 2003. 180 [BSW99] E. Ben-Sasson and A Wigderson. Short proofs are narrow—resolution made simple. Proceedings of the 31st annual ACM Symposium on Theory of Computing, ACM Press, New York, pages 517–526, 1999. 83 [BSZ12] J. Bourgain, P. Sarnak, and T. Ziegler. Distjointness of Moebius from horocycle flows. arXiv preprint arXiv:1110.0992, 2012. 104 [BT91] J. Bourgain and L. Tzafriri. On a problem of Kadison and Singer. Journal Fur Die Reine Und Angewandte Mathematik, 420:1–43, 1991. 160 [Bul06] Andrei A Bulatov. A dichotomy theorem for constraint satisfaction problems on a 3-element set. Journal of the ACM (JACM), 53(1):66–120, 2006. 53 [Bul17] Andrei A Bulatov. A dichotomy theorem for nonuniform CSPs. arXiv preprint arXiv:1703.03021, 2017. 53 [Bus87] S. Buss. Polynomial size proofs of the propositional pigeonhole principle. J. Symbolic Logic, 52:916–927, 1987. 82 [BV97] E. Bernstein and U. Vazirani. Quantum complexity theory. SIAM Journal on Com- puting, 26(5):1411–1473, 1997. 132 [BV14] Zvika Brakerski and Vinod Vaikuntanathan. Efficient fully homomorphic encryption from (standard) LWE. SIAM Journal on Computing, 43(2):831–871, 2014. 248

[BY13] Jean Bourgain and Amir Yehudayoﬀ. Expansion in SL2(R) and monotone expanders. Geometric and Functional Analysis, 23(1):1–41, 2013. 112 [BYJKS02] Ziv Bar-Yossef, T. S. Jayram, Ravi Kumar, and D. Sivakumar. Information theory methods in communication complexity. In Computational Complexity, 2002. Proceed- ings. 17th IEEE Annual Conference on, pages 72–81. IEEE, 2002. 187, 188, 199 [Can01] Ran Canetti. Universally composable security: A new paradigm for cryptographic protocols. In Foundations of Computer Science, 2001. Proceedings. 42nd IEEE Sym- posium on, pages 136–145. IEEE, 2001. 246

325 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Cay45] Arthur Cayley. On the theory of linear transformations. Number 1. E. Johnson, 1845. 171 [CC12] Jin-Yi Cai and Xi Chen. Complexity of counting csp with complex weights. In Proceedings of the forty-fourth annual ACM symposium on Theory of computing, pages 909–920. ACM, 2012. 53

[CCD88] David Chaum, Claude Cr´epeau, and Ivan Damg˚ard. Multiparty unconditionally secure protocols. In Proceedings of the twentieth annual ACM symposium on Theory of computing, pages 11–19. ACM, 1988. 247 [CCD+03] Andrew M. Childs, Richard Cleve, Enrico Deotto, Edward Farhi, Sam Gutmann, and Daniel A. Spielman. Exponential algorithmic speedup by a quantum walk. In Proceedings of the thirty-ﬁfth annual ACM symposium on Theory of computing, pages 59–68. ACM, 2003. 135 [CCL10] J. Cai, X. Chen, and D. Li. Quadratic lower bound for permanent vs. determinant in any characteristic. computational complexity, 19(1):37–56, 2010. 152

[CDD+99] Ronald Cramer, Ivan Damg˚ard,Stefan Dziembowski, Martin Hirt, and Tal Rabin. Efficient multiparty computations secure against an adaptive adversary. In Interna- tional Conference on the Theory and Applications of Cryptographic Techniques, pages 311–326. Springer, 1999. 246 [CDNO97] Rein Canetti, Cynthia Dwork, Moni Naor, and Rafail Ostrovsky. Deniable encryption. In Annual International Cryptology Conference, pages 90–104. Springer, 1997. 239 [CDT09] Xi Chen, Xiaotie Deng, and Shang-Hua Teng. Settling the complexity of computing two-player Nash equilibria. Journal of the ACM (JACM), 56(3):14, 2009. 50, 291 [CEI96] M. Clegg, J. Edmonds, and R. Impagliazzo. Using the Gröbnerbasis algorithm to find proofs of unsatisfiability. Proceedings of the 28th annual ACM Symposium on Theory of Computing, ACM Press,New York, pages 174–183, 1996. 77 [CG88] Benny Chor and Oded Goldreich. Unbiased bits from sources of weak randomness and probabilistic communication complexity. SIAM Journal on Computing, 17(2):230– 261, 1988. 118

[CGH+15] Jean-SébastienCoron, Craig Gentry, Shai Halevi, Tancrede Lepoint, Hemanta K Maji, Eric Miles, Mariana Raykova, Amit Sahai, and Mehdi Tibouchi. Zeroizing without low-level zeroes: New MMAP attacks and their limitations. In Annual Cryp- tology Conference, pages 247–266. Springer, 2015. 249 [CGMA85] Benny Chor, Shafi Goldwasser, Silvio Micali, and Baruch Awerbuch. Verifiable secret sharing and achieving simultaneity in the presence of faults. In Foundations of Computer Science, 1985., 26th Annual Symposium on, pages 383–395. IEEE, 1985. 246 [CGW89] F. R. K. Chung, R. L. Graham, and R. M. Wilson. Quasi-random graphs. Combina- torica, 9(4):345–362, 1989. 108, 109

326 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Cha93] Soma Chaudhuri. More choices allow more faults: Set consensus problems in totally asynchronous systems. Information and Computation, 105(1):132–158, 1993. 260, 263 [Cha12] Bernard Chazelle. Natural algorithms and inﬂuence systems. Communications of the ACM, 55(12):101–110, 2012. 286, 294

[Cha15] Bernard Chazelle. An algorithmic approach to collective behavior. Journal of Statis- tical Physics, 158(3):514–548, 2015. 286, 294 [Che70] Jeﬀ Cheeger. A lower bound for the smallest eigenvalue of the Laplacian. Problems in Analysis, 625:195–199, 1970. 110

[CHPW98] Anne Condon, Lisa Hellerstein, Samuel Pottle, and Avi Wigderson. On the power of finite automata with both nondeterministic and probabilistic states. SIAM Journal on Computing, 27(3):739–762, 1998. 184 [CHSH69] John F. Clauser, Michael A. Horne, Abner Shimony, and Richard A. Holt. Proposed experiment to test local hidden-variable theories. Physical review letters, 23(15):880, 1969. 140, 142 [Chv73] V. Chvátal.Edmonds polytopes and a hierarchy of combinatorial problems. Discrete Math., 4:305–337, 1973. 78 [CJW06] James A Carlson, Arthur Jaffe, and Andrew Wiles. The Millennium Prize Problems. American Mathematical Soc., 2006. 34 [CKGS98] Benny Chor, Eyal Kushilevitz, Oded Goldreich, and Madhu Sudan. Private information retrieval. Journal of the ACM (JACM), 45(6):965–981, 1998. 249 [CKL13] Bruce Ian Carlin, Shimon Kogan, and Richard Lowery. Trading complex assets. The Journal of finance, 68(5):1937–1960, 2013. 293

[CKM+11] Paul Christiano, Jonathan A Kelner, Aleksander Madry, Daniel A Spielman, and Shang-Hua Teng. Electrical ﬂows, laplacian systems, and faster approximation of maximum ﬂow in undirected graphs. In Proceedings of the forty-third annual ACM symposium on Theory of computing, pages 273–282. ACM, 2011. 273

[CKSU05] Henry Cohn, Robert Kleinberg, Bal´azsSzegedy, and Christopher Umans. Group- theoretic algorithms for matrix multiplication. In Foundations of Computer Science, 2005. FOCS 2005. 46th Annual IEEE Symposium on, pages 379–388. IEEE, 2005. 149 [CKW11] X. Chen, N. Kayal, and A. Wigderson. Partial derivatives in arithmetic complexity and beyond. Now Publishers Inc, 2011. 144, 155

[CLO92] D. Cox, J. Little, and D. O’Shea. Ideals, varieties, and algorithms: an introduction to computational algebraic geometry and commutative algebra, 1992. 171

327 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[CLPV13] Erick Chastain, Adi Livnat, Christos Papadimitriou, and Umesh Vazirani. Multi- plicative updates in coordination games and the theory of evolution. In Proceedings of the 4th conference on Innovations in Theoretical Computer Science, pages 57–58. ACM, 2013. 209 [CLPV14] Erick Chastain, Adi Livnat, Christos Papadimitriou, and Umesh Vazirani. Algo- rithms, games, and evolution. Proceedings of the National Academy of Sciences, 111(29):10620–10623, 2014. 48, 286 [CLR01] T. H. Cormen, C. Leiserson, and R. Rivest. Introduction to Algorithms. MIT Press, Cambridge, MA, McGraw-Hill Book Co., New York, 2001. 28 [CLRS16] Siu On Chan, James R Lee, Prasad Raghavendra, and David Steurer. Approximate constraint satisfaction requires large LP relaxations. Journal of the ACM (JACM), 63(4):34, 2016. 272 [CM84] K. Mani Chandy and Jayadev Misra. The drinking philosophers problem. ACM Transactions on Programming Languages and Systems (TOPLAS), 6(4):632–646, 1984. 256 [CM13] T. Cubitt and A. Montanaro. Complexity classification of local Hamiltonian problems. arXiv preprint arXiv:1311.3161, 2013. 138 [Cob65] A. Cobham. The intrinsic computational difficulty of functions. Logic, Methodology, and Philosophy of Science, North Holland, Amsterdam, pages 24–30, 1965. 26 [Coh15] G. Cohen. Two-source dispersers for polylogarithmic entropy and improved Ramsey graphs. In Electronic Colloquium on Computational Complexity (ECCC), volume TR15-095, 2015. 103 [Coh16] Michael B Cohen. Ramanujan graphs in polynomial time. arXiv preprint arXiv:1604.03544, 2016. 113 [Col06] Roger Andrew Colbeck. Quantum and relativistic protocols for secure multi-party computation. PhD thesis, Trinity College, University of Cambridge, 2006. 142 [Con92] Anne Condon. The complexity of stochastic games. Information and Computation, 96(2):203–224, 1992. 40 [Con93] A. Condon. On algorithms for simple stochastic games. Advances in computational complexity theory, 13:51–73, 1993. 52 [Coo71] S. A. Cook. The complexity of theorem-proving procedures. Proceedings of the 3rd annual ACM Symposium on Theory of Computing, ACM Press, New York, pages 151–158, 1971. 33, 42 [Coo02] G. Cooperman. Towards a practical, theoretically sound algorithm for random generation in finite groups. arXiv preprint math/0205203, 2002. 164 [Cor11] Graham Cormode. Sketch techniques for approximate query processing. Synposes for Approximate Query Processing: Samples, Histograms, Wavelets and Sketches, Foundations and Trends in Databases. NOW publishers, 2011. 180

328 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Cov69] R. R. Coveyou. Random number generation is too important to be left to chance. Ap- plied Probability and Monte Carlo Methods and modern aspects of dynamics. Studies in applied mathematics, 3:70–111, 1969. 94 [Cov91] Thomas M. Cover. Universal portfolios. Mathematical ﬁnance, 1(1):1–29, 1991. 212

[CPRR16] Stephen A Cook, Toniann Pitassi, Robert Robere, and Benjamin Rossman. Ex- ponential lower bounds for monotone span programs. In Electronic Colloquium on Computational Complexity (ECCC), volume 23, page 64, 2016. 69 [CR79] S. A. Cook and R. A. Reckhow. The relative eﬃciency of propositional proof systems. J. Symbolic Logic, 44:36–50, 1979. 74, 75, 82

[CRVW02] Michael Capalbo, Omer Reingold, Salil Vadhan, and Avi Wigderson. Randomness conductors and constant-degree lossless expanders. In Proceedings of the thiry-fourth annual ACM symposium on Theory of computing, pages 659–668. ACM, 2002. 111, 112, 274 [CS88] V. Chv´ataland E. Szemer´edi.Many hard examples for resolution. J. ACM, 35(4):759– 768, 1988. 82 [CSWY01] Amit Chakrabarti, Yaoyun Shi, Anthony Wirth, and Andrew Yao. Informational complexity and the direct sum problem for simultaneous message complexity. In Foundations of Computer Science, 2001. Proceedings. 42nd IEEE Symposium on, pages 270–278. IEEE, 2001. 199, 200

[CU03] Henry Cohn and Christopher Umans. A group-theoretic approach to fast matrix multiplication. In Foundations of Computer Science, 2003. Proceedings. 44th Annual IEEE Symposium on, pages 438–449. IEEE, 2003. 149 [CU13] Henry Cohn and Christopher Umans. Fast matrix multiplication using coherent configurations. In Proceedings of the Twenty-Fourth Annual ACM-SIAM Symposium on Discrete Algorithms, pages 1074–1086. SIAM, 2013. 149 [CV86] Richard Cole and Uzi Vishkin. Deterministic coin tossing with applications to optimal parallel list ranking. Information and Control, 70(1):32–53, 1986. 267 [CvD10] Andrew M. Childs and Wim van Dam. Quantum algorithms for algebraic problems. Reviews of Modern Physics, 82(1):1, 2010. 134 [CW89] Aviad Cohen and Avi Wigderson. Dispersers, deterministic amplification, and weak random sources. In Foundations of Computer Science, 1989., 30th Annual Symposium on, pages 14–19. IEEE, 1989. 122 [CY14] Matthew Coudron and Henry Yuen. Infinite randomness expansion with a constant number of devices. In Proceedings of the 46th Annual ACM Symposium on Theory of Computing, pages 427–436. ACM, 2014. 143 [CZ12] J. Ignacio Cirac and Peter Zoller. Goals and opportunities in quantum simulation. Nature Physics, 8(4):264–266, 2012. 137

329 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[CZ15] E. Chattopadhyay and D. Zuckerman. Explicit two-source extractors and resilient functions. In Electronic Colloquium on Computational Complexity (ECCC), volume TR15-119, 2015. 103 [DA01] Peter Dayan and Laurence F Abbott. Theoretical neuroscience, volume 806. Cam- bridge, MA: MIT Press, 2001. 287

[Dav71] R. O. Davies. Some remarks on the Kakeya problem. In Mathematical Proceedings of the Cambridge Philosophical Society, volume 69, pages 417–421. Cambridge Univ Press, 1971. 158 [DDN03] Danny Dolev, Cynthia Dwork, and Moni Naor. Nonmalleable cryptography. SIAM review, 45(4):727–784, 2003. 239 [DdW09] Andrew Drucker and Ronald de Wolf. Quantum proofs for classical theorems. arXiv preprint arXiv:0910.3376, 2009. 142 [Del74] P. Deligne. La conjecture de Weil. I. Publications Math´ematiquesde l’Institut des Hautes Etudes´ Scientiﬁques, 43(1):273–307, 1974. 104

[Del80] P. Deligne. La conjecture de Weil. II. Publications math´ematiques de l’IHES´ , 52(1):137–252, 1980. 104 [Der17] Zahra Derakhshandeh. Algorithmic Foundations of Self-Organizing Programmable Matter. PhD thesis, Arizona State University, 2017. 285

[Deu85] David Deutsch. Quantum theory, the Church-Turing principle and the universal quantum computer. In Proceedings of the Royal Society of London A: Mathematical, Physical and Engineering Sciences, volume 400, pages 97–117. The Royal Society, 1985. 132, 281 [DFH+15] Cynthia Dwork, Vitaly Feldman, Moritz Hardt, Toniann Pitassi, Omer Reingold, and Aaron Leon Roth. Preserving statistical validity in adaptive data analysis. In Pro- ceedings of the Forty-Seventh Annual ACM on Symposium on Theory of Computing, pages 117–126. ACM, 2015. 296 [DFK91] M. Dyer, A. Frieze, and R. Kannan. A random polynomial-time algorithm for approximating the volume of convex bodies. Journal of the ACM (JACM), 38(1):1–17, 1991. 88, 165 [DFP04] Marie Duﬂot, Laurent Fribourg, and Claudine Picaronny. Randomized dining philosophers without fairness assumption. Distributed Computing, 17(1):65–76, 2004. 256, 257 [DG16] Zeev Dvir and Sivakanth Gopi. 2-server PIR with subpolynomial communication. Journal of the ACM (JACM), 63(4):39, 2016. 273 [DGP09] Constantinos Daskalakis, Paul W. Goldberg, and Christos H. Papadimitriou. The complexity of computing a Nash equilibrium. SIAM Journal on Computing, 39(1):195–259, 2009. 50, 291

330 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[DH76] W. Diﬃe and M. Hellman. New directions in cryptography. IEEE Trans. Information Theory, 22:644–654, 1976. 57, 58, 235, 238 [Dia88] P. Diaconis. Group representations in probability and statistics. Lecture Notes- Monograph Series, pages i–192, 1988. 165

[Dij65] E. W. Dijkstra. Solution of a problem in concurrent programming control. Commu- nications of the ACM, 8(9):569, 1965. 255 [Dij71] Edsger W. Dijkstra. Hierarchical ordering of sequential processes. Acta informatica, 1(2):115–138, 1971. 255 [Din07] I. Dinur. The PCP Theorem by gap ampliﬁcation. J. ACM, 54(12), 2007. 130

[Dix08] J. D. Dixon. Generating random elements in ﬁnite groups. The electronic journal of combinatorics, 13(R94):1, 2008. 164 [DK15] Harm Derksen and Gregor Kemper. Computational invariant theory. Springer, 2015. 171

[DK16] Vincent Danos and Heinz Koeppl. Self-assembly and self-organization in computer science and biology (dagstuhl seminar 15402). In Dagstuhl Reports, volume 5. Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik, 2016. 285 [DK17] Irit Dinur and Tali Kaufman. High dimensional expanders imply agreement expanders. In Electronic Colloquium on Computational Complexity (ECCC), volume 24, page 89, 2017. 274 [DKSS13] Z. Dvir, S. Kopparty, S. Saraf, and M. Sudan. Extensions to the method of multiplic- ities, with applications to Kakeya sets and mergers. SIAM Journal on Computing, 42(6):2305–2328, 2013. 159

[DL78] R. A. DeMillo and R. J. Lipton. A probabilistic remark on algebraic program testing. Information Processing Letters, 7(4):193–195, 1978. 86 [DLL62] M. Davis, G. Logemann, and D. Loveland. A machine program for theorem proving. J. ACM, 5(7):394–397, 1962. 82 [DM15] Harm Derksen and Visu Makam. Polynomial degree bounds for matrix semi- invariants. arXiv preprint arXiv:1512.03393, 2015. 174, 175 [DM16] Irit Dinur and Or Meir. Toward the krw composition conjecture: cubic formula lower bounds via communication complexity. In Proceedings of the 31st Conference on Computational Complexity, page 3. Schloss Dagstuhl–Leibniz-Zentrum fuer Infor- matik, 2016. 67

[Don92] S. Donkin. Invariants of several matrices. Inventiones mathematicae, 110(1):389–401, 1992. 174 [DR14] Cynthia Dwork and Aaron Roth. The algorithmic foundations of diﬀerential privacy. Foundations and Trends in Theoretical Computer Science, 9(3-4):211–407, 2014. 233

331 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[DR16] Daniel Dadush and Oded Regev. Towards strong reverse Minkowski-type inequalities for lattices. In Foundations of Computer Science (FOCS), 2016 IEEE 57th Annual Symposium on, pages 447–456. IEEE, 2016. 170 [DS90] Cynthia Dwork and Larry Stockmeyer. A time complexity gap for two-way probabilistic finite-state automata. SIAM Journal on Computing, 19(6):1011–1023, 1990. 184 [DS92] Cynthia Dwork and Larry Stockmeyer. Finite state verifiers I: the power of interaction. Journal of the ACM (JACM), 39(4):800–828, 1992. 184 [DS07] Z. Dvir and A. Shpilka. Locally decodable codes with two queries and polynomial identity testing for depth 3 circuits. SIAM Journal on Computing, 36(5):1404–1434, 2007. 159 [DS13] A. De and R. Servedio. Efficient deterministic approximate counting for low-degree polynomial threshold functions. arXiv preprint arXiv:1311.7178, 2013. 115 [DSS14] Amit Daniely and Shai Shalev-Shwartz. Complexity theoretic limitations on learning DNF’s. CoRR, abs/1404.3378, 1(2.1):2–1, 2014. 231 [DSTW14] I. Diakonikolas, R. A. Servedio, L. Tan, and A. Wan. A regularity lemma and low- weight approximators for low-degree polynomial threshold functions. Theory of Com- puting, 10(2):27–53, 2014. 116

[DSVW04] Martin Dyer, Alistair Sinclair, Eric Vigoda, and Dror Weitz. Mixing in time and space for lattice spin systems: A combinatorial view. Random Structures & Algorithms, 24(4):461–479, 2004. 166, 276 [DSW14] Zeev Dvir, Shubhangi Saraf, and Avi Wigderson. Improved rank bounds for design matrices and a new proof of Kelly’s theorem. In Forum of Mathematics, Sigma, volume 2. Cambridge University Press, 2014. 273

[Dvi09] Z. Dvir. On the size of Kakeya sets in ﬁnite ﬁelds. Journal of the American Mathe- matical Society, 22(4):1093–1097, 2009. 121, 159 [Dvi10] Z. Dvir. Guest column: from randomness extraction to rotating needles. ACM SIGACT News, 40(4):46–61, 2010. 159

[DW00] Harm Derksen and Jerzy Weyman. Semi-invariants of quivers and saturation for Littlewood-Richardson coeﬃcients. Journal of the American Mathematical Society, 13(3):467–479, 2000. 175 [DW06] Harm Derksen and Jerzy Weyman. The combinatorics of quiver representations. arXiv preprint math/0608288, 2006. 174

[DW11] Z. Dvir and A. Wigderson. Kakeya sets, new mergers, and old extractors. SIAM Journal on Computing, 40(3):778–792, 2011. 121 [DZ01] Matyas Domokos and Alexander N Zubkov. Semi-invariants of quivers as determinants. Transformation groups, 6(1):9–24, 2001. 175

332 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Edm65a] J. Edmonds. Paths, trees, and ﬂowers. Canad. J. Math., 17(3):449–467, 1965. 26, 28, 195 [Edm65b] Jack Edmonds. Maximum matching and a polyhedron with 0, l-vertices. J. Res. Nat. Bur. Standards B, 69(1965):125–130, 1965. 195

[Edm66] J. Edmonds. Minimum partition of a matroid into independent sets. Journal of research of the National Bureou of Standards, B(69):67–72, 1966. 33, 37, 38 [Edm67] Jack Edmonds. Systems of distinct representatives and linear algebra. J. Res. Nat. Bur. Standards Sect. B, 71:241–245, 1967. 153 [Edm68] Jack Edmonds. Optimum branchings. Mathematics and the Decision Sciences, Part, 1:335–345, 1968. 26 [Efr12] Klim Efremenko. 3-query locally decodable codes of subexponential length. SIAM Journal on Computing, 41(6):1694–1703, 2012. 273 [EGL85] Shimon Even, Oded Goldreich, and Abraham Lempel. A randomized protocol for signing contracts. Communications of the ACM, 28(6):637–647, 1985. 246 [EGO84] Abbas El Gama and Alon Orlitsky. Interactive data compression. In Proc. 25th Ann. symp. Foundations Computer Science, l984, pages 100–108, 1984. 201 [EGSZ16] Faith Ellen, Rati Gelashvili, Nir Shavit, and Leqi Zhu. A complexity-based hierarchy for multiprocessor synchronization. arXiv preprint arXiv:1607.06139, 2016. 253

[EHKS14] Kirsten Eisentr¨ager,Sean Hallgren, Alexei Kitaev, and Fang Song. A quantum algorithm for computing the unit group of an arbitrary degree number ﬁeld. In Proceedings of the 46th Annual ACM Symposium on Theory of Computing, pages 293–302. ACM, 2014. 134

[EK10] David Easley and Jon Kleinberg. Networks, crowds, and markets: Reasoning about a highly connected world. Cambridge University Press, 2010. 48, 293 [Eke91] A. K. Ekert. Quantum cryptography based on Bell’s theorem. Physical review letters, 67(6):661, 1991. 136 [ElG85] Taher ElGamal. A public key cryptosystem and a signature scheme based on discrete logarithms. IEEE transactions on information theory, 31(4):469–472, 1985. 58 [Eli57] Peter Elias. List decoding for noisy channels. 1957. 273 [EPR35] A. Einstein, B. Podolsky, and N. Rosen. Can quantum-mechanical description of physical reality be considered complete? Physical review, 47(10):777, 1935. 140

[ER59] P. Erd˝osand A. R´enyi. On random graphs, I. Publicationes Mathematicae, 6:290–297, 1959. 108 [ER60] P. Erd˝osand A. R´enyi. On the evolution of random graphs. Publ. Math. Inst. Hungar. Acad. Sci, 5:17–61, 1960. 108

333 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Erd47] P. Erd˝os.Some remarks on the theory of graphs. Bulletin of the American Mathe- matical Society, 53(4):292–294, 1947. 100, 101 [Fár48] IstvánFáry. On straight lines representation of plane graphs. Acta. Sci. Math. Szeged, 11:229–233, 1948. 25

[Fel71] W. Feller. An introduction to probability theory and its applications. Wiley series in probability and mathematical statistics., 1971. 167 [Fel91] Michael R Fellows. Computer science and mathematics in the elementary schools. University of Victoria, Department of Computer Science, 1991. https://larc.unt.edu/ian/research/cseducation/fellows1991.pdf. 307

[Fey82] R. P. Feynman. Simulating physics with computers. International journal of theoretical physics, 21(6):467–488, 1982. 132, 281, 283 [Fey86] Richard P Feynman. Quantum mechanical computers. Foundations of physics, 16(6):507–531, 1986. 283

[FG98] Edward Farhi and Sam Gutmann. Quantum computation and decision trees. Physical Review A, 58(2):915, 1998. 135 [FGGS00] E. Farhi, J. Goldstone, S. Gutmann, and M. Sipser. Quantum computation by adiabatic evolution. arXiv preprint quant-ph/0001106, 2000. 139 [FGL+96] U. Feige, S. Goldwasser, L. Lov´asz,S. Safra, and M. Szegedy. Interactive proofs and the hardness of approximating cliques. J. ACM, pages 268–292, 1996. 131, 272 [FHL80] Merrick Furst, John Hopcroft, and Eugene Luks. Polynomial-time algorithms for permutation groups. In Foundations of Computer Science, 1980., 21st Annual Sym- posium on, pages 36–41. IEEE, 1980. 30

[FK96] A. Frieze and R. Kannan. The regularity lemma and approximation schemes for dense problems. In Foundations of Computer Science, 1996. Proceedings., 37th Annual Symposium on, pages 12–20. IEEE, 1996. 115 [FK01] Uriel Feige and Joe Kilian. Heuristics for semirandom graph problems. Journal of Computer and System Sciences, 63(4):639–671, 2001. 55, 301

[FKLW03] Michael Freedman, Alexei Kitaev, Michael Larsen, and Zhenghan Wang. Topological quantum computation. Bulletin of the American Mathematical Society, 40(1):31–38, 2003. 139 [FKO07] Uriel Feige, Guy Kindler, and Ryan O’Donnell. Understanding parallel repetition requires understanding foams. In Computational Complexity, 2007. CCC’07. Twenty- Second Annual IEEE Conference on, pages 179–192. IEEE, 2007. 168 [FLP85] Michael J. Fischer, Nancy A. Lynch, and Michael S. Paterson. Impossibility of distributed consensus with one faulty process. Journal of the ACM (JACM), 32(2):374– 382, 1985. 258, 260

334 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[FLvMV05] Lance Fortnow, Richard Lipton, Dieter van Melkebeek, and Anastasios Viglas. Time- space lower bounds for satisﬁability. Journal of the ACM (JACM), 52(6):835–865, 2005. 180 [FMP+15] Samuel Fiorini, Serge Massar, Sebastian Pokutta, Hans Raj Tiwary, and Ronald De Wolf. Exponential lower bounds for polytopes in combinatorial optimization. Journal of the ACM (JACM), 62(2):17, 2015. 196, 272 [For66] G. D. Forney. Concatenated codes, volume 11. Citeseer, 1966. 102, 274 [For84] E. Formanek. Invariants and the ring of generic matrices. Journal of Algebra, 89(1):178–223, 1984. 174

[For94] L. Fortnow. The role of relativization in complexity theory. Bull. EATCS, 52:229–244, 1994. 62 [For00] L. Fortnow. Time–space tradeoﬀs for satisﬁability. Journal of Computer and System Sciences, 60(2):337–353, 2000. 61, 180

[For13] Lance Fortnow. The golden ticket: P, NP, and the search for the impossible. Princeton University Press Princeton, 2013. 35 [FR03] Faith Fich and Eric Ruppert. Hundreds of impossibility results for distributed computing. Distributed computing, 16(2-3):121–163, 2003. 252 [Fre81] R¯usi¸nˇsFreivalds. Probabilistic two-way machines. In International Symposium on Mathematical Foundations of Computer Science, pages 33–45. Springer, 1981. 183, 184 [Fre90] Yoav Freund. Boosting a weak learning algorithm by majority. In COLT, volume 90, pages 202–216, 1990. 227

[FRS88] Lance Fortnow, John Rompel, and Michael Sipser. On the power of multi-power interactive protocols. In Structure in Complexity Theory Conference, 1988. Proceedings., Third Annual, pages 156–161. IEEE, 1988. 130 [FS95] Yoav Freund and Robert E Schapire. A desicion-theoretic generalization of on-line learning and an application to boosting. In European conference on computational learning theory, pages 23–37. Springer, 1995. 229 [FS99] Yoav Freund and Robert E Schapire. Adaptive game playing using multiplicative weights. Games and Economic Behavior, 29(1):79–103, 1999. 211, 212 [FS13] M. A. Forbes and A. Shpilka. Explicit noether normalization for simultaneous conjugation via polynomial identity testing. In Approximation, Randomization, and Combinatorial Optimization. Algorithms and Techniques, pages 527–542. Springer, 2013. 174, 175 [FSS84] M. Furst, J. Saxe, and M. Sipser. Parity, circuits and the polynomial time hierarchy. Math. Systems Theory, 17:13–27, 1984. 66, 69

335 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[F¨ur09] Martin F¨urer. Faster integer multiplication. SIAM Journal on Computing, 39(3):979– 1005, 2009. 65 [FV98] T. Feder and M. Y. Vardi. The computational structure of monotone monadic SNP and constraint satisfaction: A study through Datalog and group theory. SIAM Jour- nal on Computing, 28(1):57–104, 1998. 53

[FW81] P. Frankl and R. M. Wilson. Intersection theorems with geometric consequences. Combinatorica, 1(4):357–368, 1981. 103 [Gab72] P. Gabriel. Unzerlegbare darstellungen I. Manuscripta Mathematica, 6(1):71–103, 1972. 174

[Gal62] Robert Gallager. Low-density parity-check codes. IRE Transactions on information theory, 8(1):21–28, 1962. 274 [GBGL10] Timothy Gowers, June Barrow-Green, and Imre Leader. The Princeton companion to mathematics. Princeton University Press, 2010.3

[Gel15] Ran Gelles. Coding for interactive communication: a survey. Survey, 2015. http: //www.cs.princeton.edu/~rgelles/papers/survey.pdf. 202 [Gen09a] C. Gentry. Fully homomorphic encryption using ideal lattices. In STOC, volume 9, pages 169–178, 2009. 171, 248 [Gen09b] Craig Gentry. A fully homomorphic encryption scheme. PhD thesis, Stanford Uni- versity, 2009. 248 [GGH+13] Sanjam Garg, Craig Gentry, Shai Halevi, Mariana Raykova, Amit Sahai, and Brent Waters. Candidate indistinguishability obfuscation and functional encryption for all circuits. In Foundations of Computer Science (FOCS), 2013 IEEE 54th Annual Symposium on, pages 40–49. IEEE, 2013. 249

[GGHR14] Sanjam Garg, Craig Gentry, Shai Halevi, and Mariana Raykova. Two-round secure MPC from indistinguishability obfuscation. In Theory of Cryptography Conference, pages 74–94. Springer, 2014. 250 [GGM86] O. Goldreich, S. Goldwasser, and S. Micali. How to construct random functions. Journal of the ACM (JACM), 33(4):792–807, 1986. 96, 105, 230 [GGOW15] Ankit Garg, Leonid Gurvits, Rafael Oliveira, and Avi Wigderson. A deterministic polynomial time algorithm for non-commutative rational identity testing. arXiv preprint arXiv:1511.03730, 2015. 153, 176, 273 [GGOW16] Ankit Garg, Leonid Gurvits, Rafael Oliveira, and Avi Wigderson. Algorithmic aspects of brascamp-lieb inequalities. arXiv preprint arXiv:1607.06711, 2016. 176 [GH14] Mohsen Ghaﬀari and Bernhard Haeupler. Optimal error rates for interactive coding II: Eﬃciency and list decoding. In Foundations of Computer Science (FOCS), 2014 IEEE 55th Annual Symposium on, pages 394–403. IEEE, 2014. 204

336 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[GHK+16] Ran Gelles, Bernhard Haeupler, Gillat Kol, Noga Ron-Zewi, and Avi Wigderson. Towards optimal deterministic coding for interactive communication. In Proceedings of the Twenty-Seventh Annual ACM-SIAM Symposium on Discrete Algorithms, pages 1922–1936. SIAM, 2016. 205 [GHL14] S. Gharibian, Y. Huang, and Z. Landau. Quantum Hamiltonian complexity. arXiv preprint arXiv:1401.3916, 2014. 137 [GHSY12] Parikshit Gopalan, Cheng Huang, Huseyin Simitci, and Sergey Yekhanin. On the locality of codeword symbols. IEEE Transactions on Information Theory, 58(11):6925– 6934, 2012. 273

[Gil52] Edgar N. Gilbert. A comparison of signalling alphabets. Bell System Technical Journal, 31(3):504–522, 1952. 203 [Gil77] J. Gill. Computational complexity of probabilistic Turing machines. SIAM J. Com- put., 6:675–695, 1977. 87 [Gil98] David Gillman. A Chernoff bound for random walks on expander graphs. SIAM Journal on Computing, 27(4):1203–1220, 1998. 122 [GJ79] M. R. Garey and D. S. Johnson. Computers and Intractability: A Guide to the Theory of NP-Completeness. W.H. Freeman and Company, New York, 1979. 43, 44 [GJL16] Heng Guo, Mark Jerrum, and Jingcheng Liu. Uniform sampling through the Lovász local lemma. arXiv preprint arXiv:1611.01647, 2016. 166, 276 [GK86] S. Goldwasser and J. Kilian. Almost all primes can be quickly certified. In Proceedings of the eighteenth annual ACM symposium on Theory of computing, pages 316–329. ACM, 1986. 157 [GK10] L. Guth and N. H. Katz. On the Erd˝osdistinct distance problem in the plane. arXiv preprint arXiv:1011.4105, 2010. 159 [GK16] Shafi Goldwasser and Yael Tauman Kalai. Cryptographic assumptions: A position paper. In Theory of Cryptography Conference, pages 505–522. Springer, 2016. 236, 303

[GKKS13] A. Gupta, P. Kamath, N. Kayal, and R. Saptharishi. Approaching the chasm at depth four. In Computational Complexity (CCC), 2013 IEEE Conference on, pages 65–73. IEEE, 2013. 154 [GKM+00] Yael Gertner, Sampath Kannan, Tal Malkin, Omer Reingold, and Mahesh Viswanathan. The relationship between public key encryption and oblivious transfer. In Foundations of Computer Science, 2000. Proceedings. 41st Annual Symposium on, pages 325–335. IEEE, 2000. 244 [GKR08] Shaﬁ Goldwasser, Yael Tauman Kalai, and Guy N Rothblum. Delegating computation: interactive proofs for muggles. In Proceedings of the fortieth annual ACM symposium on Theory of computing, pages 113–122. ACM, 2008. 248

337 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[GKR14] Anat Ganor, Gillat Kol, and Ran Raz. Exponential separation of information and communication. In Foundations of Computer Science (FOCS), 2014 IEEE 55th An- nual Symposium on, pages 176–185. IEEE, 2014. 202 [GKR15] Anat Ganor, Gillat Kol, and Ran Raz. Exponential separation of information and communication. In Symposium on the Theory of Computing (STOC), pages 557–?566. ACM, 2015. 202 [GL89] O. Goldreich and L. A. Levin. A hard-core predicate for all one-way functions. In Pro- ceedings of the twenty-ﬁrst annual ACM symposium on Theory of computing, pages 25–32. ACM, 1989. 273

n [GLR10] V. Guruswami, J. R. Lee, and A. Razborov. Almost Euclidean subspaces of `1 via expander codes. Combinatorica, 30(1):47–68, 2010. 159 [GM82] Shaﬁ Goldwasser and Silvio Micali. Probabilistic encryption & how to play mental poker keeping secret all partial information. In Proceedings of the fourteenth annual ACM symposium on Theory of computing, pages 365–377. ACM, 1982. 243

[GM84] S. Goldwasser and S. Micali. Probabilistic encryption. J. Comput. System Sci., 28:270–299, 1984. 59, 90, 92, 93, 238, 240 [GMR89] S. Goldwasser, S. Micali, and C. Rackoﬀ. The knowledge complexity of interactive proof systems. SIAM J. Comput., 18(1):186–208, 1989. 124, 125, 128, 164 [GMW87] O. Goldreich, S. Micali, and A. Wigderson. How to play any mental game. Proceedings of the 19th annual ACM Symposium on Theory of Computing, ACM Press, New York, pages 218–229, 1987. 59, 129, 184, 243, 244, 246, 292 [GMW91] O. Goldreich, S. Micali, and A. Wigderson. Proofs that yield nothing but their validity, or all languages in NP have zero-knowledge proof systems. J. ACM, 38(1):691–729, 1991. 123, 128, 129, 241, 245, 246, 296

[GMWW14] Dmitry Gavinsky, Or Meir, Omri Weinstein, and Avi Wigderson. Toward better formula lower bounds: an information complexity approach to the krw composition conjecture. In Proceedings of the forty-sixth annual ACM symposium on Theory of computing, pages 213–222. ACM, 2014. 67

[GNW11] Oded Goldreich, Noam Nisan, and Avi Wigderson. On Yao’s XOR-lemma. In Studies in Complexity and Cryptography. Miscellanea on the Interplay between Randomness and Computation, pages 273–301. Springer, 2011. 98 [Goe97] M. X. Goemans. Semideﬁnite programming in combinatorial optimization. Mathe- matical Programming, 79(1-3):143–161, 1997. 161

[Gol67] E Mark Gold. Language identiﬁcation in the limit. Information and control, 10(5):447–474, 1967. 218 [Gol97] O. Goldreich. Notes on Levin’s theory of average-case complexity. ECCC, TR97-058, 1997. 56

338 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Gol99] O. Goldreich. Modern cryptography, probabilistic proofs and pseudorandomness. Algorithms Combin. Springer-Verlag, Berlin, 17, 1999. 86, 89, 94, 123 [Gol04] O. Goldreich. Foundations of Cryptography. Cambridge University Press, Cambridge, 2001; 2004. I. Basic Tools; II. Basic Applications. 56, 92, 94, 233, 236, 244 [Gol08] O. Goldreich. Computational Complexity: A Conceptual Perspective. Cambridge University Press, Cambridge, 2008. 14, 89 [Gol10] Oded Goldreich. Property testing: current research and surveys, volume 6390. Springer, 2010. 109 [Gow01] W. T. Gowers. A new proof of Szemer´edi’stheorem. Geometric and Functional Analysis, 11(3):465–588, 2001. 114 [GR07] Shaﬁ Goldwasser and Guy N. Rothblum. On best-possible obfuscation. In Theory of Cryptography Conference, pages 194–213. Springer, 2007. 250 [GR08] V. Guruswami and A. Rudra. Explicit codes achieving list decoding capacity: Error- correction with optimal redundancy. Information Theory, IEEE Transactions on, 54(1):135–150, 2008. 121, 273 [Gra05] A. Granville. It is easy to determine whether a given integer is prime. Bull. Amer. Math. Soc., 42:3–38, 2005. 28, 157 [Gri01a] D. Grigoriev. Complexity of Positivstellensatz proofs for the knapsack. Computational Complexity, 10(2):139–154, 2001. 80, 272 [Gri01b] D. Grigoriev. Linear lower bound on degrees of Positivstellensatz calculus proofs for the parity. Theoretical Computer Science, 259(1):613–622, 2001. 81, 272 [Gro87] M. Gromov. Essays in group theory. Math. Sci. Res. Inst. Publ, 8:75–263, 1987. 30 [Gro96] Lov K Grover. A fast quantum mechanical algorithm for database search. In Pro- ceedings of the twenty-eighth annual ACM symposium on Theory of computing, pages 212–219. ACM, 1996. 134 [Gro03] Mikhail Gromov. Random walk in random groups. Geometric and Functional Anal- ysis, 13(1):73–146, 2003. 72, 162 [Gro10] M. Gromov. Singularities, expanders and topology of maps. part 2: From combinatorics to topology via algebraic isoperimetry. Geometric and Functional Analysis, 20(2):416–526, 2010. 113 [GRS90] R. L. Graham, B. L. Rothschild, and J. H. Spencer. Ramsey theory. Joe Wiley and Sons, New York, 1990. 100

[GRS16] V. Guruswami, A. Rudra, and M. Sudan. Essential Coding Theory. 2016. http: //www.cse.buffalo.edu/faculty/atri/courses/coding-theory/book/. 102 [GS71] R. L. Graham and J. H. Spencer. A constructive solution to a tournament problem. Canad. Math. Bull, 14(1):45–48, 1971. 102, 104

339 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[GS89] S. Goldwasser and M. Sipser. Private coins versus public coins in interactive proof systems, volume 5 of Advances in Computing Research. JAI Press, Inc., Greenwich, CT, 1989. Silvio Micali, ed. 123, 124, 126 [GS98] Venkatesan Guruswami and Madhu Sudan. Improved decoding of Reed-Solomon and algebraic-geometric codes. In Foundations of Computer Science, 1998. Proceedings. 39th Annual Symposium on, pages 28–37. IEEE, 1998. 273 [GS00] Oded Goldreich and Shmuel Safra. A combinatorial consistency lemma with application to proving the PCP theorem. SIAM Journal on Computing, 29(4):1132–1154, 2000. 274

[GS06] Oded Goldreich and Madhu Sudan. Locally testable codes and PCPs of almost-linear length. Journal of the ACM (JACM), 53(4):558–655, 2006. 274 [GS14] Leonid Gurvits and Alex Samorodnitsky. Bounds on the permanent and some applications. In Foundations of Computer Science (FOCS), 2014 IEEE 55th Annual Symposium on, pages 90–99. IEEE, 2014. 276

[GST14] Daniel Genkin, Adi Shamir, and Eran Tromer. RSA key extraction via low-bandwidth acoustic cryptanalysis. In International Cryptology Conference, pages 444–461. Springer, 2014. 250 [GT09] B. Green and T. Tao. The distribution of polynomials over ﬁnite ﬁelds, with applications to the Gowers norms. Contributions to Discrete Mathematics, 4(2):1–36, 2009. 115 [GTZ12] B. Green, T. Tao, and T. Ziegler. An inverse theorem for the Gowers U s+1[N]-norm. Annals of Mathematics, 176(2):1231–1372, 2012. 116 [Gur08] Leonid Gurvits. Van der Waerden/Schrijver-Valiant like conjectures and stable (aka hyperbolic) homogeneous polynomials: one theorem for all. the electronic journal of combinatorics, 15(1):R66, 2008. 161 [GUV09] V. Guruswami, C. Umans, and S. Vadhan. Unbalanced expanders and randomness extractors from Parvaresh–Vardy codes. Journal of the ACM (JACM), 56(4):20, 2009. 121

[GV01] D. Grigoriev and N. Vorobjov. Complexity of Null- and Positivstellensatz proofs. Annals of Pure and Applied Logic, 113(1):153–160, 2001. 80 [GV08] Anita Goel and Viola Vogel. Harnessing biological motors to engineer systems for nanoscale transport and assembly. Nature nanotechnology, 3(8):465–475, 2008. 284

[GW96] Oded Goldreich and Avi Wigderson. Theory of computation: A scientiﬁc perspective. 1996. http://www.wisdom.weizmann.ac.il/~oded/toc-sp2.html. 270 [GW11] Craig Gentry and Daniel Wichs. Separating succinct non-interactive arguments from all falsiﬁable assumptions. In Proceedings of the forty-third annual ACM symposium on Theory of computing, pages 99–108. ACM, 2011. 236

340 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Had10] Jacques Hadamard. Note sur quelques applications de l’indice de Kronecker. 1910. 262 [Hae14] Bernhard Haeupler. Interactive channel capacity revisited. In Foundations of Com- puter Science (FOCS), 2014 IEEE 55th Annual Symposium on, pages 226–235. IEEE, 2014. 204

[Hak61] W. Haken. Theorie der Normalflächen: Ein Isotopiekriterium fürden Kreisknoten. Acta Math., 105:245–375, 1961. 22 [Hak85] A. Haken. The intractability of resolution. Theor. Comput. Sci., 39:297–308, 1985. 82

[HAK07] Elad Hazan, Amit Agarwal, and Satyen Kale. Logarithmic regret algorithms for online convex optimization. Machine Learning, 69(2-3):169–192, 2007. 212 [Ham50] Richard W. Hamming. Error detecting and error correcting codes. Bell System technical journal, 29(2):147–160, 1950. 202

[Har16] Daniel Harlow. Jerusalem lectures on black holes and quantum information. Reviews of Modern Physics, 88(1):015002, 2016. 288 [H˚as89] Johan H˚astad.Almost optimal lower bounds for small depth circuits. In Randomness And Computation, 1989. 96 [H˚as98] J. H˚astad.The shrinkage exponent of de Morgan formulas is 2. SIAM Journal on Computing, 27(1):48–64, 1998. 66, 67 [H˚as99] J. H˚astad. Clique is hard to approximate within n1−. Acta Math., 182:105–142, 1999. 131 [H˚as01] J. H˚astad.Some optimal inapproximability results. J. ACM, 48:798–859, 2001. 131

[Has07] M. B. Hastings. An area law for one-dimensional quantum systems. Journal of Statistical Mechanics: Theory and Experiment, 2007(08):P08024, 2007. 138 [Hat10] H. Hatami. A structure theorem for Boolean functions with small total inﬂuences. arXiv preprint arXiv:1008.1021, 2010. 116

[Haz16] Elad Hazan. Introduction to online convex optimization. Foundations and Trends R in Optimization, 2(3-4):157–325, 2016. 206 [HC99] Armin Haken and Stephen A. Cook. An exponential lower bound for the size of monotone real circuits. Journal of Computer and System Sciences, 58(2):326–335, 1999. 80

[Hea08] A. D. Healy. Randomness-eﬃcient sampling within NC1. Computational Complexity, 17(1):3–37, 2008. 122 [HEO05] D. F. Holt, B. Eick, and E. A. O’Brien. Handbook of computational group theory. CRC Press, 2005. 163

341 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Her91] Maurice Herlihy. Wait-free synchronization. ACM Transactions on Programming Languages and Systems (TOPLAS), 13(1):124–149, 1991. 258, 259 [HH13] Daniel Harlow and Patrick Hayden. Quantum computation vs. ﬁrewalls. Journal of High Energy Physics, 6:085, 2013. 48, 289

[Hil93] D. Hilbert. Uber¨ die vollen Invariantensysteme. Mathematische Annalen, 42(3):313– 373, 1893. 172, 174 [HILL99] J. H˚astad,R. Impagliazzo, L. A. Levin, and M. Luby. A pseudorandom generator from any one-way function. SIAM Journal on Computing, 28(4):1364–1396, 1999. 95 [HJ16] Yupu Hu and Huiwen Jia. Cryptanalysis of GGH map. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 537– 565. Springer, 2016. 249 [HKR13] Maurice Herlihy, Dmitry Kozlov, and Sergio Rajsbaum. Distributed computing through combinatorial topology. Newnes, 2013. 261, 266

[HL72] O. J. Heilmann and E. H. Lieb. Theory of monomer-dimer systems. Communications in Mathematical Physics, 25(3):190–232, 1972. 164 [HLP99] J. Hass, J. C. Lagarias, and N. Pippenger. The computational complexity of knot and link problems. J. ACM, 46:185–211, 1999. 40, 43, 52 [HLW06] S. Hoory, N. Linial, and A. Wigderson. Expander graphs and their applications. Bulletin of the American Mathematical Society, 43(4):439–561, 2006. 110, 160 [HO13] Brett Hemenway and Rafail Ostrovsky. Building lossy trapdoor functions from lossy encryption. In International Conference on the Theory and Application of Cryptology and Information Security, pages 241–260. Springer, 2013. 244

[Hoa78] Charles Antony Richard Hoare. Communicating sequential processes. In The origin of concurrent programming, pages 413–443. Springer, 1978. 255 [Hru12] Pavel Hrubeˇs.On the nonnegative rank of distance matrices. Information Processing Letters, 112(11):457–461, 2012. 196, 197 [HS65] J. Hartmanis and R. E. Stearns. On the computational complexity of algorithms. Transactions of the American Mathematical Society, 117:285–306, 1965. 61 [HS99] Maurice Herlihy and Nir Shavit. The topological structure of asynchronous computability. Journal of the ACM (JACM), 46(6):858–923, 1999. 261, 263, 265 [HS11] Maurice Herlihy and Nir Shavit. On the nature of progress. In International Confer- ence On Principles Of Distributed Systems, pages 313–328. Springer, 2011. 254 [HS17] Samuel B Hopkins and David Steurer. Bayesian estimation from few samples: community detection and related problems. arXiv preprint arXiv:1710.00264, 2017. 55, 301

342 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[HSSW98] David P. Helmbold, Robert E. Schapire, Yoram Singer, and Manfred K. Warmuth. On-line portfolio selection using multiplicative updates. Mathematical Finance, 8(4):325–347, 1998. 212 [HT74] John Hopcroft and Robert Tarjan. Eﬃcient planarity testing. Journal of the ACM (JACM), 21(4):549–568, 1974. 28

[Huf52] David Huﬀman. A method for the construction of minimum-redundancy codes. Pro- ceedings of the IRE, 9(40):1098–1101, 1952. 200 [HW87] David Haussler and Emo Welzl. ε-nets and simplex range queries. Discrete & Com- putational Geometry, 2(2):127–151, 1987. 224

[HW03] Johan H˚astadand Avi Wigderson. Simple analysis of graph tests for linearity and PCP. Random Structures & Algorithms, 22(2):139–160, 2003. 98 [HW14] P. Hrubeˇsand A. Wigderson. Non-commutative arithmetic circuits with division. In Proceedings of the 5th conference on Innovations in theoretical computer science, pages 49–66. ACM, 2014. 155

[HWY10] P. Hrubeˇs,A. Wigderson, and A. Yehudayoﬀ. Non-commutative circuits and the sum- of-squares problem. In Proceedings of the forty-second ACM symposium on Theory of computing, pages 667–676. ACM, 2010. 155 [HY11] P. Hrubeˇsand A. Yehudayoﬀ. Arithmetic complexity in algebraic extensions. Theory of Computing, 7(8):119–129, 2011. 145

[Hya79] L. Hyaﬁl. On the parallel evaluation of multivariate polynomials. SIAM Journal on Computing, 8(2):120–123, 1979. 146, 150 [IKW02] R. Impagliazzo, V. Kabanets, and A. Wigderson. In search of an easy witness: Ex- ponential time vs. probabilistic polynomial time. Journal of Computer Systems and Sciences, 65(4):672–694, 2002. 98 [IKW12] Russell Impagliazzo, Valentine Kabanets, and Avi Wigderson. New direct-product testers and 2-query pcps. SIAM Journal on Computing, 41(6):1722–1768, 2012. 274 [IL90] Russell Impagliazzo and Leonid A. Levin. No better ways to generate hard NP instances than picking uniformly at random. In Foundations of Computer Science, 1990. Proceedings., 31st Annual Symposium on, pages 812–821. IEEE, 1990. 55 [Imm88] Neil Immerman. Nondeterministic space is closed under complementation. SIAM Journal on computing, 17(5):935–938, 1988. 179 [Imp95a] R. Impagliazzo. Hard-core distributions for somewhat hard problems. In Foundations of Computer Science, 1995. Proceedings., 36th Annual Symposium on, pages 538–545. IEEE, 1995. 115 [Imp95b] R. Impagliazzo. A personal view of average-case complexity. Proceedings of the 10th IEEE Annual Conference on Structure in Complexity Theory, IEEE Comput. Soc. Press, Los Alamitos, CA, pages 134–147, 1995. 56

343 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Ind00] Piotr Indyk. Stable distributions, pseudorandom generators, embeddings and data stream computation. In Foundations of Computer Science, 2000. Proceedings. 41st Annual Symposium on, pages 189–197. IEEE, 2000. 181 [INW94] Russell Impagliazzo, Noam Nisan, and Avi Wigderson. Pseudorandomness for network algorithms. In Proceedings of the twenty-sixth annual ACM symposium on The- ory of computing, pages 356–364. ACM, 1994. 108, 197, 198 [IP01] Russell Impagliazzo and Ramamohan Paturi. On the complexity of k-SAT. Journal of Computer and System Sciences, 62:367–375, 2001. 64, 273 [IPU94] Russell Impagliazzo, Toniann Pitassi, and Alasdair Urquhart. Upper and lower bounds for tree-like cutting planes proofs. In Logic in Computer Science, 1994. LICS’94. Proceedings., Symposium on, pages 220–228. IEEE, 1994. 193, 194 [IPZ01] Russell Impagliazzo, Ramamohan Paturi, and Francis Zane. Which problems have strongly exponential complexity? Journal of Computer and System Sciences, 63(4):512–530, 2001. 64, 273 [IQS15] Gábor Ivanyos, Youming Qiao, and KV Subrahmanyam. Non-commutative Edmonds’ problem and matrix semi-invariants. arXiv preprint arXiv:1508.00690, 2015. 176 [IV12] T. Ito and T. Vidick. A multi-prover interactive proof for NEXP sound against entangled provers. In Foundations of Computer Science (FOCS), 2012 IEEE 53rd Annual Symposium on, pages 243–252. IEEE, 2012. 140 [IW97] R. Impagliazzo and A. Wigderson. P = BPP unless E has subexponential circuits: Derandomizing the XOR lemma. Proceedings of the 29th annual ACM Symposium on Theory of Computing, ACM Press, New York, pages 220–229, 1997. 89, 98, 121, 157 [IW98] R. Impagliazzo and A. Wigderson. Randomness vs. time: De-randomization under a uniform assumption. Proceedings of the 39th Annual Symposium on Foundations of Computer Science, IEEE Comput. Soc. Press, Los Alamitos, CA, 1998, pages 734–743, 1998. 89 [IZ89] Russell Impagliazzo and David Zuckerman. How to recycle random bits. In Founda- tions of Computer Science, 1989., 30th Annual Symposium on, pages 248–253. IEEE, 1989. 122 [Jac94] Jeffrey Jackson. An efficient membership-query algorithm for learning DNF with respect to the uniform distribution. In Foundations of Computer Science, 1994 Pro- ceedings., 35th Annual Symposium on, pages 42–53. IEEE, 1994. 231 [Jer92] Mark Jerrum. Large cliques elude the metropolis process. Random Structures & Algorithms, 3(4):347–359, 1992. 276 [JJUW10] R. Jain, Z. Ji, S. Upadhyay, and J. Watrous. QIP=PSPACE. Communications of the ACM, 53(12):102–109, 2010. 140 [Joh92] D. Johnson. The tale of the second prover. J. Algorithms, 13(3):502–524, 1992. 123

344 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[JP04] Neil C Jones and Pavel Pevzner. An introduction to bioinformatics algorithms. MIT press, 2004. 284 [JS89] Mark Jerrum and Alistair Sinclair. Approximating the permanent. SIAM journal on computing, 18(6):1149–1178, 1989. 276

[JS93] Mark Jerrum and Gregory B Sorkin. Simulated annealing for graph bisection. In Foundations of Computer Science, 1993. Proceedings., 34th Annual Symposium on, pages 94–103. IEEE, 1993. 166, 276 [JS96] M. Jerrum and A. Sinclair. The Markov chain Monte Carlo method: an approach to approximate counting and integration. Approximation algorithms for NP-hard problems, pages 482–520, 1996. 165, 276 [JSV04] M. Jerrum, A. Sinclair, and E. Vigoda. A polynomial-time approximation algorithm for the permanent of a matrix with nonnegative entries. Journal of the ACM (JACM), 51(4):671–697, 2004. 88, 165, 276 [Juk12] S. Jukna. Boolean function complexity: advances and frontiers, volume 27. Springer, 2012. 62 [Jus72] J. Justesen. Class of constructive asymptotically good algebraic codes. Information Theory, IEEE Transactions on, 18(5):652–656, 1972. 102 [JVV86] M. R. Jerrum, Leslie G. Valiant, and V. V. Vazirani. Random generation of combinatorial structures from a uniform distribution. Theoretical Computer Science, 43:169–188, 1986. 165, 275 [Kah74] David Kahn. The codebreakers. Weidenfeld and Nicolson, 1974. 239 [Kah95] Nabil Kahale. Eigenvalues and expansion of regular graphs. Journal of the ACM (JACM), 42(5):1091–1106, 1995. 111

[Kah96] David Kahn. The Codebreakers: The comprehensive history of secret communication from ancient times to the internet. Simon and Schuster, 1996. 233 [Kal83] E. Kaltofen. Polynomial factorization. Computer Algebra: Symbolic and Algebraic Computation, 2nd ed., Springer-Verlag, Wien, New York, 583:95–113, 1983. 88

[Kal85] K. A. Kalorkoti. A lower bound for the formula size of rational functions. SIAM Journal on Computing, 14(3):678–687, 1985. 150 [Kan12] D. M. Kane. A structure theorem for poorly anticoncentrated Gaussian chaoses and applications to the study of polynomial threshold functions. In Foundations of Computer Science (FOCS), 2012 IEEE 53rd Annual Symposium on, pages 91–100. IEEE, 2012. 115 [Kar72] R. Karp. Reducibility among combinatorial problems. Complexity of Computer Com- putations (R. E. Miller and J. W. Thatcher, eds.), Plenum Press, New York, pages 85–103, 1972. 43, 44, 45

345 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Kar76] Richard M Karp. The probabilistic analysis of some combinatorial search algorithms. Algorithms and complexity: New directions and recent results, 1:19, 1976. 55, 301 [Kar84] N. Karmarkar. A new polynomial-time algorithm for linear programming. Combina- torica, 4:373–394, 1984. 28, 39, 272

[Kar11] Richard M. Karp. Understanding science through the computational lens. Journal of Computer Science and Technology, 26(4):569–577, 2011. 48 [Kha79] L. Khachian. A polynomial time algorithm for linear programming. Soviet Math. Doklady, 10:191–194, 1979. 28, 39 [Kha93] Michael Kharitonov. Cryptographic hardness of distribution-speciﬁc learning. In Pro- ceedings of the twenty-ﬁfth annual ACM symposium on Theory of computing, pages 372–381. ACM, 1993. 231 [Kho02] S. Khot. On the power of unique 2-prover 1-round games. In Proceedings of the thiry-fourth annual ACM symposium on Theory of computing, pages 767–775. ACM, 2002. 54, 162, 272

[Kho10] S. Khot. Inapproximability of NP-complete problems, discrete Fourier analysis, and geometry. In International Congress of Mathematics, volume 5, 2010. 55, 162 [Khr72] V. M. Khrapchenko. A method of obtaining lower bounds for the complexity of π- schemes. Mat. Zametki, 10(1):83–92, 1972. (in Russian). English translation in Math. Notes Acad. Sci. USSR 10 (1972) 474–479. 66

[KI04] V. Kabanets and R. Impagliazzo. Identity tests means proving circuit lower bounds. Comput. Complexity, 13(1–2):1–46, 2004. 98, 153 [Kil88] Joe Kilian. Founding cryptography on oblivious transfer. In Proceedings of the twentieth annual ACM symposium on Theory of computing, pages 20–31. ACM, 1988. 184 [Kit03] A. Yu Kitaev. Fault-tolerant quantum computation by anyons. Annals of Physics, 303(1):2–30, 2003. 136, 137 [KKL88] J. Kahn, G. Kalai, and N. Linial. The inﬂuence of variables on Boolean functions. In Foundations of Computer Science, 1988., 29th Annual Symposium on, pages 68–80. IEEE, 1988. 167 [KKMO07] S. Khot, G. Kindler, E. Mossel, and R. O’Donnell. Optimal inapproximability results for MAX-CUT and other 2-variable CSPs? SIAM Journal on Computing, 37(1):319– 357, 2007. 167

[KL82] R. Karp and R. J. Lipton. Turing machines that take advice. Enseign. Math., 2(28 (3–4)):191–209, 1982. 64 [KL08] T. Kaufman and S. Lovett. Worst case to average case reductions for polynomials. In The 49th Annual IEEE Symposium on Foundations of Computer Science (FOCS 2008), pages 166–175. IEEE, 2008. 115

346 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Kle51] Stephen Cole Kleene. Representation of events in nerve nets and ﬁnite automata. Technical report, DTIC Document, 1951. 182 [Kle00] Jon Kleinberg. The small-world phenomenon: An algorithmic perspective. In Pro- ceedings of the thirty-second annual ACM symposium on Theory of computing, pages 163–170. ACM, 2000. 294

[KLN06] Martin Kassabov, Alexander Lubotzky, and Nikolay Nikolov. Finite simple groups as expanders. Proceedings of the National Academy of Sciences, 103(16):6116–6119, 2006. 112 [KLOS14] Jonathan A Kelner, Yin Tat Lee, Lorenzo Orecchia, and Aaron Sidford. An almost- linear-time algorithm for approximate max flow in undirected graphs, and its mul- ticommodity generalizations. In Proceedings of the twenty-fifth annual ACM-SIAM symposium on Discrete algorithms, pages 217–226. SIAM, 2014. 273 [KLS01] Michael Kearns, Michael L Littman, and Satinder Singh. Graphical models for game theory. In Proceedings of the Seventeenth conference on Uncertainty in artificial intelligence, pages 253–260. Morgan Kaufmann Publishers Inc., 2001. 291

[KMRZS17] Swastik Kopparty, Or Meir, Noga Ron-Zewi, and Shubhangi Saraf. High-rate locally correctable and locally testable codes with sub-polynomial query complexity. Journal of the ACM (JACM), 64(2):11, 2017. 274 [KMSY14] Gillat Kol, Shay Moran, Amir Shpilka, and Amir Yehudayoﬀ. Approximate nonnegative rank is equivalent to the smooth rectangle bound. In International Colloquium on Automata, Languages, and Programming, pages 701–712. Springer, 2014. 187 [KN97] E. Kushilevitz and N. Nisan. Communication Complexity. Cambridge University Press, Cambridge, 1997. 185 [Koi12] P. Koiran. Arithmetic circuits: The chasm at depth four gets wider. Theoretical Computer Science, 448:56–65, 2012. 154 [KORW08] Guy Kindler, Ryan O’Donnell, Anup Rao, and Avi Wigderson. Spherical cubes and rounding in high dimensions. In Foundations of Computer Science, 2008. FOCS’08. IEEE 49th Annual IEEE Symposium on, pages 189–198. IEEE, 2008. 169

[KP89] Jan Kraj´ıˇcekand Pavel Pudl´ak.Propositional proof systems, the consistency of ﬁrst order theories and the complexity of computations. The Journal of Symbolic Logic, 54(03):1063–1079, 1989. 84 [KP95] Elias Koutsoupias and Christos H. Papadimitriou. On the k-server conjecture. Journal of the ACM (JACM), 42(5):971–983, 1995. 208, 209

[KP99] Elias Koutsoupias and Christos Papadimitriou. Worst-case equilibria. In Stacs, volume 99, pages 404–413. Springer, 1999. 291 [KPS85] R. Karp, N. Pippenger, and M. Sipser. A time-randomness tradeoﬀ. In AMS Con- ference on Probabilistic Computational Complexity, 1985. 111

347 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[KPW92] JánosKomlós,JánosPach, and Gerhard Woeginger. Almost tight bounds for ε-nets. Discrete & Computational Geometry, 7(2):163–173, 1992. 224 [KR13] Gillat Kol and Ran Raz. Interactive channel capacity. In Proceedings of the forty-fifth annual ACM symposium on Theory of computing, pages 715–724. ACM, 2013. 204

[Kra94] Jan Kraj´ıˇcek. Lower bounds to the size of constant-depth propositional proofs. The Journal of Symbolic Logic, 59(01):73–86, 1994. 84 [Kra95] Jan Kraj´ıˇcek. Bounded arithmetic, propositional logic and complexity theory. Cam- bridge University Press, 1995. 71, 73 [Kri64] Jean-Louis Krivine. Anneaux préordonnés. Journal d’analyse mathématique, 12(1):307–326, 1964. 80 [KRR14] Yael Tauman Kalai, Ran Raz, and Ron D Rothblum. How to delegate computations: the power of no-signaling proofs. In Proceedings of the 46th Annual ACM Symposium on Theory of Computing, pages 485–494. ACM, 2014. 142, 248, 249

[KRT16] Gillat Kol, Ran Raz, and Avishay Tal. Time-space hardness of learning sparse pari- ties. TR16-113, 2016. 232 [KRW95] M. Karchmer, R. Raz, and A. Wigderson. Super-logarithmic depth lower bounds via the direct sum in communication complexity. Computational Complexity, 5(3-4):191– 204, 1995. 67, 69, 202

[KS59] R. V. Kadison and I. M. Singer. Extensions of pure states. American journal of mathematics, pages 383–400, 1959. 159 [KS92] Bala Kalyanasundaram and Georg Schintger. The probabilistic communication complexity of set intersection. SIAM Journal on Discrete Mathematics, 5(4):545–557, 1992. 187, 188

1/3 [KS01] Adam R. Klivans and Rocco Servedio. Learning DNF in time 2o˜(n ). In Proceedings of the thirty-third annual ACM symposium on Theory of computing, pages 258–265. ACM, 2001. 231 [KS09] Neeraj Kayal and Shubhangi Saraf. Blackbox polynomial identity testing for depth 3 circuits. In Foundations of Computer Science, 2009. FOCS’09. 50th Annual IEEE Symposium on, pages 198–207. IEEE, 2009. 159, 273 [KS13] Valerie King and Jared Saia. Byzantine agreement in polynomial expected time. In Proceedings of the forty-ﬁfth annual ACM symposium on Theory of computing, pages 401–410. ACM, 2013. 260

[KS17] Pravesh K Kothari and David Steurer. Outlier-robust moment-estimation via sum- of-squares. arXiv preprint arXiv:1711.11581, 2017. 55, 301 [KSV02] A. Y. Kitaev, A. Shen, and M. N. Vyalyi. Classical and quantum computation, volume 47. American Mathematical Soc., 2002. 132, 137

348 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[KSZ+10] Seung Hyeon Ko, Min Su, Chuan Zhang, Alexander E Ribbe, Wen Jiang, and Chengde Mao. Synergistic self-assembly of RNA and DNA molecules. Nature chemistry, 2(12):1050–1055, 2010. 284 [KT06] Jon Kleinberg and Eva Tardos. Algorithm design. Pearson Education India, 2006. 28 [Kup14] G. Kuperberg. Knottedness is in NP, modulo GRH. Advances in Mathematics, 256:493–506, 2014. 52 [KV94a] Michael Kearns and Leslie Valiant. Cryptographic limitations on learning Boolean formulae and finite automata. Journal of the ACM (JACM), 41(1):67–95, 1994. 230, 231 [KV94b] Michael J. Kearns and Umesh Virkumar Vazirani. An introduction to computational learning theory. MIT press, 1994. 221 [KV03] Adam Kalai and Santosh Vempala. Efficient algorithms for universal portfolios. The Journal of Machine Learning Research, 3:423–440, 2003. 212 [KV05] S. A. Khot and N. K. Vishnoi. The unique games conjecture, integrality gap for cut problems and embeddability of negative type metrics into `1. In 46th Annual IEEE Symposium on Foundations of Computer Science, 2005., pages 53–62. IEEE, 2005. 161, 162 [KW90] M. Karchmer and A. Wigderson. Monotone circuits for connectivity require super- logarithmic depth. SIAM J. Discrete Math., 3(2):255–265, 1990. 66, 68, 69, 190, 191, 192 [KY06] G. Kasparov and G. Yu. The coarse geometric Novikov conjecture and uniform convexity. Advances in Mathematics, 206(1):1–56, 2006. 162 [LAA87] Michael C Loui and Hosame H Abu-Amara. Memory requirements for agreement among unreliable asynchronous processes. advances in Computer Research, 4:163– 183, 1987. 259 [Lac15] Marc Lackenby. A polynomial upper bound on Reidemeister moves. Annals of Math- ematics, 182:491–564, 2015. 40, 52, 72 [Lac16] Marc Lackenby. The efficient certification of knottedness and Thurston norm. arXiv preprint arXiv:1604.00290, 2016. 52 [Lad75] R. Ladner. On the structure of polynomial time reducibility. J. ACM, 22(1):155–171, 1975. 50 [Laf08] V. Lafforgue. Un renforcement de la propriété(T). Duke Mathematical Journal, 143(3):559–602, 2008. 162 [Lag84] J. C. Lagarias. Knapsack public key cryptosystems and Diophantine approximation. In Advances in cryptology, pages 3–23. Springer, 1984. 171 [Lan17] Joseph Landsberg. Geometry and complexity theory. Cambridge University press, 2017. 173

349 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Las01] J. B. Lasserre. Global optimization with polynomials and the problem of moments. SIAM Journal on Optimization, 11(3):796–817, 2001. 80 [Las09] J. Lasserre. Moments, positive polynomials and their applications, volume 1. World Scientiﬁc, 2009. 81

[Len83] H. W. Lenstra. Integer programming with a ﬁxed number of variables. Mathematics of operations research, 8(4):538–548, 1983. 170 [Lev73] L. A. Levin. Universal search problems. Probl. Peredaci Inform., 9:115–116, 1973. English transl. Probl. Inf. Transm. 9 (1973), 265–266. 33, 42 [Lev86] L. A. Levin. Average case complete problems. SIAM J. Comput., 15(1):285–286, 1986. 55, 301 [Lev87] L. A. Levin. One-way functions and pseudorandom generators. Combinatorica, 7(4):357–363, 1987. 59 [LFKN90] C. Lund, L. Fortnow, H. Karloﬀ, and N. Nisan. Algebraic methods for interactive proof systems. Proceedings of the 31th Annual Symposium on Foundations of Com- puter Science, IEEE Comput. Soc. Press, Los Alamitos, CA, pages 2–10, 1990. 125 [Lin92] Nathan Linial. Locality in distributed graph algorithms. SIAM Journal on Comput- ing, 21(1):193–201, 1992. 267 [Lin02] N. Linial. Finite metric spaces-combinatorics, geometry and algorithms. In In Pro- ceedings of the International Congress of Mathematicians III, pages 573–586. Citeseer, 2002. 161 [Lin17] Yehuda Lindell. How to simulate it – a tutorial on the simulation proof technique. In Electronic Colloquium on Computational Complexity (ECCC), volume TR17-112, 2017. 239

[Lip91] R. Lipton. New directions in testing. DIMACS Distributed Computing and Cryptog- raphy, American Math Society, 2:191–202, 1991. 126 [Lip94] R. Lipton. Straight-line complexity and integer factorization. In Leonard M. Adleman and Ming-Deh A. Huang, editors, Algorithmic number theory, pages 71–79. Springer, 1994. 144

[Lip95] Richard J Lipton. DNA solution of hard computational problems. Science, 268(5210):542, 1995. 284 [LLL82] A. K. Lenstra, H. W. Lenstra, and L. Lov´asz. Factoring polynomials with rational coeﬃcients. Mathematische Annalen, 261(4):515–534, 1982. 30, 169, 170

[LLR95] Nathan Linial, Eran London, and Yuri Rabinovich. The geometry of graphs and some of its algorithmic applications. Combinatorica, 15(2):215–245, 1995. 161 [LLS84] Richard E Ladner, Richard J Lipton, and Larry J Stockmeyer. Alternating pushdown and stack automata. SIAM Journal on Computing, 13(1):135–155, 1984. 183

350 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[LM06] N. Linial and R. Meshulam. Homological connectivity of random 2-complexes. Com- binatorica, 26(4):475–487, 2006. 113 [LMM03] Richard J Lipton, Evangelos Markakis, and Aranyak Mehta. Playing large games using simple strategies. In Proceedings of the 4th ACM conference on Electronic commerce, pages 36–41. ACM, 2003. 291

[LMS11] Daniel Lokshtanov, D´anielMarx, and Saket Saurabh. Lower bounds based on the exponential time hypothesis. Bulletin of the EATCS, (105):41–72, 2011. 64 [LMSS01] Michael G Luby, Michael Mitzenmacher, Mohammad Amin Shokrollahi, and Daniel A Spielman. Improved low-density parity-check codes using irregular graphs. IEEE Transactions on information Theory, 47(2):585–598, 2001. 274

[LN15] Massimo Lauria and Jakob Nordström.Tight size-degree bounds for sums-of-squares proofs. In Proceedings of the 30th Conference on Computational Complexity, pages 448–466. Schloss Dagstuhl–Leibniz-Zentrum fuer Informatik, 2015. 81 [Lov12] LászlóLovász. Large networks and graph limits, volume 60. American Mathematical Soc., 2012. 109, 279 [Lov14] Shachar Lovett. Recent advances on the log-rank conjecture in communication complexity. arXiv preprint arXiv:1403.8106, 2014. 185, 186 [LP06] Adi Livnat and Nicholas Pippenger. An optimal brain can be composed of conflicting agents. Proceedings of the National Academy of Sciences of the United States of America, 103(9):3198–3202, 2006. 286 [LP09] LászlóLovászand Michael D. Plummer. Matching theory, volume 367. American Mathematical Soc., 2009. 28 [LP16] Adi Livnat and Christos Papadimitriou. Sex as an algorithm: the theory of evolution under the lens of computation. Communications of the ACM, 59(11):84–93, 2016. 286 [LPDF08] Adi Livnat, Christos Papadimitriou, Jonathan Dushoff, and Marcus W Feldman. A mixability theory for the role of sex in evolution. Proceedings of the National Academy of Sciences, 105(50):19803–19808, 2008. 286

[LPPF10] Adi Livnat, Christos Papadimitriou, Nicholas Pippenger, and Marcus W Feldman. Sex, mixability, and modularity. Proceedings of the National Academy of Sciences, 107(4):1452–1457, 2010. 286 [LPS88] A. Lubotzky, R. Phillips, and P. Sarnak. Ramanujan graphs. Combinatorica, 8(3):261–277, 1988. 111, 112, 160

[LPS14] Jeﬀ W Lichtman, Hanspeter Pﬁster, and Nir Shavit. The big data challenges of connectomics. Nature neuroscience, 17(11):1448–1454, 2014. 288

351 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[LR81] Daniel Lehmann and Michael O Rabin. On the advantages of free choice: a symmetric and fully distributed solution to the dining philosophers problem. In Proceedings of the 8th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pages 133–138. ACM, 1981. 256, 257, 259 [LRS14] James R. Lee, Prasad Raghavendra, and David Steurer. Lower bounds on the size of semidefinite programming relaxations. arXiv preprint arXiv:1411.6317, 2014. 81, 272 [LRVW03] C. Lu, O. Reingold, S. Vadhan, and A. Wigderson. Extractors: Optimal up to constant factors. In Proceedings of the thirty-fifth annual ACM symposium on Theory of computing, pages 602–611. ACM, 2003. 159 [LS91] L. Lovászand A. Schrijver. Cones of matrices and set-functions and 0-1 optimization. SIAM Journal on Optimization, 1(2):166–190, 1991. 80 [LS+09] Troy Lee, Adi Shraibman, et al. Lower bounds in communication complexity. Foun- dations and Trends R in Theoretical Computer Science, 3(4):263–399, 2009. 187 [LS13] Yin Tat Lee and Aaron Sidford. Efficient accelerated coordinate descent methods and faster algorithms for solving linear systems. In Foundations of Computer Science (FOCS), 2013 IEEE 54th Annual Symposium on, pages 147–156. IEEE, 2013. 273 [LS14] Yin Tat Lee and Aaron Sidford. Path finding methods for linear programming: Solv- ing linear programs in o(vrank) iterations and faster algorithms for maximum flow. In Foundations of Computer Science (FOCS), 2014 IEEE 55th Annual Symposium on, pages 424–433. IEEE, 2014. 273 [LSP82] Leslie Lamport, Robert Shostak, and Marshall Pease. The Byzantine generals problem. ACM Transactions on Programming Languages and Systems (TOPLAS), 4(3):382–401, 1982. 257, 258 [LSW00] Nathan Linial, Alex Samorodnitsky, and Avi Wigderson. A deterministic strongly polynomial algorithm for matrix scaling and approximate permanents. Combinator- ica, 20(4):545–568, 2000. 276 [LT89] N. A. Lynch and M. R. Tuttle. An introduction to input/output automata. CWI Quarterly, 2(3):219–246, 1989. 257 [Lub02] Michael Luby. LT codes. In Foundations of Computer Science, 2002. Proceedings. The 43rd Annual IEEE Symposium on, pages 271–280. IEEE, 2002. 274 [Lub14] Alexander Lubotzky. Ramanujan complexes and high dimensional expanders. Japanese Journal of Mathematics, 9(2):137–169, 2014. 113 [LVV13] Zeph Landau, Umesh Vazirani, and Thomas Vidick. A polynomial-time algorithm for the ground state of 1d gapped local Hamiltonians. arXiv preprint arXiv:1307.5143, 2013. 139 [LW86] Nick Littlestone and Manfred Warmuth. Relating data compression and learnability. Technical report, Technical report, University of California, Santa Cruz, 1986. 227

352 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[LW93] Alexander Lubotzky and Benjamin Weiss. Groups and expanders. Expanding graphs (Princeton, NJ, 1992), 10:95–109, 1993. 112 [LW94] Nick Littlestone and Manfred K. Warmuth. The weighted majority algorithm. In- formation and computation, 108(2):212–261, 1994. 209, 210, 211

[Lyn89] Nancy Lynch. A hundred impossibility proofs for distributed computing. In Proceed- ings of the eighth annual ACM Symposium on Principles of distributed computing, pages 1–28. ACM, 1989. 252 [Lyn96] Nancy A. Lynch. Distributed algorithms. Morgan Kaufmann, 1996. 252 [LZ77] Richard J. Lipton and Yechezkel Zalcstein. Word problems solvable in Logspace. Journal of the ACM (JACM), 24(3):522–526, 1977. 177 [Mad13] Aleksander Madry. Navigating central path with electrical ﬂows: From ﬂows to matchings, and back. In Foundations of Computer Science (FOCS), 2013 IEEE 54th Annual Symposium on, pages 253–262. IEEE, 2013. 273

[Mal99] Juan Maldacena. The large n limit of superconformal ﬁeld theories and supergravity. In AIP Conference Proceedings CONF-981170, volume 484, pages 51–63. AIP, 1999. 289 [Man80] Yu. I. Manin. Vychislimoe i nevychislimoe (Computable and Noncomputable) (in Russian). Sov. Radio., 1980. Retrieved 4 March, 2013. 132

[Mar73] G. A. Margulis. Explicit constructions of concentrators. Problemy Peredachi Infor- matsii, 9(4):71–80, 1973. 110, 112 [Mar88] G. A. Margulis. Explicit group-theoretic constructions of combinatorial schemes and their applications in the construction of expanders and concentrators. Problems In- formation Transmission, 24:39–46, 1988. 111, 112, 160

[Mar06] Henry Markram. The blue brain project. Nature reviews. Neuroscience, 7(2):153, 2006. 287 [Mat02] Jiˇr´ıMatouˇsek. Lectures on discrete geometry, volume 108. Springer New York, 2002. 224

[McG14] Andrew McGregor. Graph stream algorithms: a survey. ACM SIGMOD Record, 43(1):9–20, 2014. 180 [Mer97] F. Mertens. Uber¨ eine zahlentheoretische Funktion. Akademie Wissenschaftlicher Wien Mathematisch-Naturwissenschaftliche Klasse, Abteilung 2a, 106:761–830, 1897. 103

[MFK82] David Mumford, John Fogarty, and Frances Kirwan. Geometric invariant theory, 1982. 173 [Mil67] Stanley Milgram. The small world problem. Phychology Today, 1:61–67, 1967. 294

353 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Mil76] G. L. Miller. Riemann’s hypothesis and tests for primality. Journal of computer and system sciences, 13(3):300–317, 1976. 39, 106, 157 [Min10] H. Minkowski. Geometrie der Zahlen. Teubner, 1910. 169 [Mit97] Thomas M. Mitchell. Machine learning. New York, 1997. 213 [MM11] C. Moore and S. Mertens. The nature of computation. Oxford University Press, 2011. 14 [MMS90] Mark S. Manasse, Lyle A. McGeoch, and Daniel D. Sleator. Competitive algorithms for server problems. Journal of Algorithms, 11(2):208–230, 1990. 208 [MN14] M. Mendel and A. Naor. Nonlinear spectral calculus and super-expanders. Publica- tions mathématiquesde l’IHES´ , 119(1):1–95, 2014. 162 [Moi16] Ankur Moitra. Approximate counting, the Lovászlocal lemma and inference in graphical models. arXiv preprint arXiv:1610.04317, 2016. 166, 276 [MOO10] E. Mossel, R. O’Donnell, and K. Oleszkiewicz. Noise stability of functions with low influences: Invariance and optimality. Annals of mathematics, 171(1):295–341, 2010. 167, 168 [Mor85] Jacques Morgenstern. How to compute fast a function and all its derivatives: A variation on the theorem of Baur-Strassen. ACM SIGACT News, 1985. 147, 148 [Mos09] Robin A Moser. A constructive proof of the Lovászlocal lemma. In Proceedings of the forty-first annual ACM symposium on Theory of computing, pages 343–350. ACM, 2009. 166, 276 [MP43] Warren S. McCulloch and Walter Pitts. A logical calculus of the ideas immanent in nervous activity. The bulletin of mathematical biophysics, 5(4):115–133, 1943. 182, 287 [MP69] Marvin Minsky and Seymour Papert. Perceptrons. 1969. 231 [MP15] Reshef Meir and David Parkes. On sex, evolution, and the multiplicative weights update algorithm. In Proceedings of the 2015 International Conference on Autonomous Agents and Multiagent Systems, pages 929–937. International Foundation for Au- tonomous Agents and Multiagent Systems, 2015. 209, 286 [MPZ02] M. Mézard,G. Parisi, and R. Zecchina. Analytic and algorithmic solution of random satisfiability problems. Science, 297(5582):812–815, 2002. 166 [MR95] R. Motwani and P. Raghavan. Randomized Algorithms. Cambridge University Press, Cambridge, 1995. 86, 88, 98 [MR04] T. Mignon and N. Ressayre. A quadratic bound for the determinant and permanent problem. International Mathematics Research Notices, 2004(79):4241–4253, 2004. 152 [MR11] E. W. Mayr and S. Ritscher. Space-efficient Gröbnerbasis computation without degree bounds. In Proceedings of the 36th international symposium on Symbolic and algebraic computation, pages 257–264. ACM, 2011. 174

354 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[MR13] Mehryar Mohri and Afshin Rostamizadeh. Perceptron mistake bounds. arXiv preprint arXiv:1305.0208, 2013. 215 [MS82] Kurt Mehlhorn and Erik M. Schmidt. Las Vegas is better than determinism in VLSI and distributed computing. In Proceedings of the fourteenth annual ACM symposium on Theory of computing, pages 330–337. ACM, 1982. 186 [MS14a] Carl A. Miller and Yaoyun Shi. Robust protocols for securely expanding randomness and distributing keys using untrusted quantum devices. In Proceedings of the 46th Annual ACM Symposium on Theory of Computing, pages 417–426. ACM, 2014. 143 [MS14b] Cristopher Moore and Leonard J. Schulman. Tree codes and a conjecture on exponential sums. In Proceedings of the 5th conference on Innovations in theoretical computer science, pages 145–154. ACM, 2014. 205 [MSS13a] A. Marcus, D. A. Spielman, and N. Srivastava. Interlacing families I: Bipartite Ra- manujan graphs of all degrees. In Foundations of Computer Science (FOCS), 2013 IEEE 54th Annual Symposium on, pages 529–537. IEEE, 2013. 112, 160 [MSS13b] A. Marcus, D. A. Spielman, and N. Srivastava. Interlacing families II: Mixed characteristic polynomials and the Kadison-Singer problem. arXiv preprint arXiv:1306.3969, 2013. 159, 160 [MT10] Robin A Moser and G´abor Tardos. A constructive proof of the general Lov´aszlocal lemma. Journal of the ACM (JACM), 57(2):11, 2010. 166, 276 [Mul11] K. D. Mulmuley. On P vs. NP and geometric complexity theory. Journal of the ACM (JACM), 58(2):5, 2011. 153, 173 [Mul12a] K. D. Mulmuley. The GCT program toward the P vs. NP problem. Communications of the ACM, 55(6):98–107, 2012. 153, 173 [Mul12b] K. D. Mulmuley. Geometric complexity theory V: Equivalence between blackbox derandomization of polynomial identity testing and derandomization of Noether’s normalization lemma. In Foundations of Computer Science (FOCS), 2012 IEEE 53rd Annual Symposium on, pages 629–638. IEEE, 2012. 174, 175 [Mum95] David Mumford. Algebraic Geometry: Complex projective varieties, volume 1. Springer Science & Business Media, 1995. 172 [Mur12] Kevin P. Murphy. Machine learning: a probabilistic perspective. MIT press, 2012. 214 [Mut05] Shanmugavelayutham Muthukrishnan. Data streams: Algorithms and applications. Now Publishers Inc, 2005. 180 [MW04] Roy Meshulam and Avi Wigderson. Expanders in group algebras. Combinatorica, 24(4):659–680, 2004. 112 [MWW16] Wenlong Mou, Zhi Wang, and Liwei Wang. Stable memory allocation in the hippocampus: Fundamental limits and neural realization. arXiv preprint arXiv:1612.04659, 2016. 287

355 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[MY16] Shay Moran and Amir Yehudayoﬀ. Sample compression schemes for VC classes. Journal of the ACM, 2016. 227 [Nao03] Moni Naor. On cryptographic assumptions and challenges. In Annual International Cryptology Conference, pages 96–109. Springer, 2003. 236 [NC10] M. A. Nielsen and I. L. Chuang. Quantum computation and quantum information. Cambridge university press, 2010. 132 [Nes00] Y. Nesterov. Squared functional systems and optimization problems. In High performance optimization, pages 405–440. Springer, 2000. 80 [New91] Ilan Newman. Private vs. common random bits in communication complexity. Infor- mation processing letters, 39(2):67–71, 1991. 187 [Nil91] Alon Nilli. On the second eigenvalue of a graph. Discrete Mathematics, 91(2):207–210, 1991. 111 [Nis91a] N. Nisan. Lower bounds for non-commutative computation. In Proceedings of the twenty-third annual ACM symposium on Theory of computing, pages 410–418. ACM, 1991. 155 [Nis91b] N. Nisan. Pseudorandom bits for constant depth circuits. Combinatorica, 11(1):63– 70, 1991. 96 [Nis92] N. Nisan. Pseudorandom generators for space-bounded computation. Combinatorica, 12(4):449–461, 1992. 108, 179, 197, 198 [Nis94] N. Nisan. RL ⊆ SC. Computational Complexity, 4(1):1–11, 1994. 179 [Nis96] N. Nisan. Extracting randomness: how and why. a survey. In Computational Complex- ity, 1996. Proceedings., Eleventh Annual IEEE Conference on, pages 44–58. IEEE, 1996. 117 [Nov62] Albert Novikoﬀ. On convergence proofs for perceptrons. In Proc. 1962 Symp. on Math. Theory of Automata, volume 12, pages 615–620, 1962. 215, 220 [NRTV07] Noam Nisan, Tim Roughgden, Eva Tardos, and Vijay V. Vazirani. Algorithmic game theory, volume 1. Cambridge University Press Cambridge, 2007. 48, 290 [NW94] N. Nisan and A. Wigderson. Hardness vs. randomness. J. Comput. System Sci., 49(2):149–167, 1994. 96, 97, 121 [NW96] N. Nisan and A. Wigderson. Lower bounds on arithmetic circuits via partial derivatives. Computational Complexity, 6(3):217–234, 1996. 155 [NY90] Moni Naor and Moti Yung. Public-key cryptosystems provably secure against chosen ciphertext attacks. In Proceedings of the twenty-second annual ACM symposium on Theory of computing, pages 427–437. ACM, 1990. 239 [NY17] Assaf Naor and Robert Young. Vertical perimeter versus horizontal perimeter. arXiv preprint arXiv:1701.00620, 2017. 162

356 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[NZ96] N. Nisan and D. Zuckerman. Randomness is linear in space. Journal of Computer and System Sciences, 52(1):43–52, 1996. 119 [O’D14] R. O’Donnell. Analysis of Boolean functions. Cambridge University Press, 2014. 55, 166

[O’D16] Ryan O’Donnell. SOS is not obviously automatizable, even approximately. 2016. 80 [Orl92] Alon Orlitsky. Average-case interactive communication. IEEE Transactions on In- formation Theory, 38(5):1534–1547, 1992. 200, 201 [Orú14] RománOrús. A practical introduction to tensor networks: Matrix product states and projected entangled pair states. Annals of Physics, 349:117–158, 2014. 138

[OtR85] A. M. Odlyzko and H. JJ. te Riele. Disproof of the Mertens conjecture. J. reine angew. Math, 357:138–160, 1985. 170 [OW93] Rafail Ostrovsky and Avi Wigderson. One-way functions are essential for non-trivial zero-knowledge. In Theory and Computing Systems, 1993., Proceedings of the 2nd Israel Symposium on the, pages 3–17. IEEE, 1993. 128 [Pal33] R. E. Paley. On orthogonal matrices. J. Math. Phys., pages 311–320, 1933. 102 [PAM+10] Stefano Pironio, Antonio Ac´ın,Serge Massar, A. Boyer de la Giroday, Dzimitry N. Matsukevich, Peter Maunz, Steven Olmschenk, David Hayes, Le Luo, T. Andrew Manning, and Christopher Monroe. Random numbers certiﬁed by Bell’s theorem. Nature, 464(7291):1021–1024, 2010. 143 [Pap94] C. H. Papadimitriou. On the complexity of the parity argument and other ineﬃcient proofs of existence. J. Comput. System Sci., 48(3):498–532, 1994. 50, 73, 291 [Pap97] C. H. Papadimitriou. NP-completeness: A retrospective. In Automata, languages and programming, pages 2–6. Springer, 1997. 45 [Pap03] C. H. Papadimitriou. Computational complexity. John Wiley and Sons Ltd., 2003. 14 [Pap14] Christos Papadimitriou. Algorithms, complexity, and the sciences. Proceedings of the National Academy of Sciences, 111(45):15881–15887, 2014. 48

[Par00] P. A. Parrilo. Structured semidefinite programs and semialgebraic geometry methods in robustness and optimization. PhD thesis, Citeseer, 2000. 80 [PB94] Pavel Pudlákand Samuel R Buss. How to lie without being (easily) convicted and the lengths of proofs in propositional calculus. In International Workshop on Computer Science Logic, pages 151–162. Springer, 1994. 193 [Pei09] Chris Peikert. Public-key cryptosystems from the worst-case shortest vector problem. In Proceedings of the forty-first annual ACM symposium on Theory of computing, pages 333–342. ACM, 2009. 248

357 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Pei16] Chris Peikert. A decade of lattice cryptography. Foundations and Trends in Theo- retical Computer Science, 10(4):283–424, 2016. 171 [Pev00] Pavel Pevzner. Computational molecular biology: an algorithmic approach. MIT Press, 2000. 284 [Pig13] Giovanni Pighizzini. Two-way finite automata: Old and recent results. Fundamenta Informaticae, 126(2-3):225–246, 2013. 183 [Pin73] M. S. Pinsker. On the complexity of a concentrator. In 7th International Telegraffic Conference, volume 4, pages 1–318. Citeseer, 1973. 110 [PPST83] Wolfgang J. Paul, Nicholas Pippenger, Endre Szemeredi, and William T. Trotter. On determinism versus non-determinism and related problems. pages 429–438, 1983. 61 [Pro76] C. Procesi. The invariant theory of n × n matrices. Advances in Mathematics, 19(3):306–381, 1976. 174 [Pud97] P. Pudlak. Lower bounds for resolution and cutting planes proofs and monotone computations. J. Symbolic Logic, 62(3):981–998, 1997. 79 [Put93] M. Putinar. Positive polynomials on compact semi-algebraic sets. Indiana University Mathematics Journal, 42(3):969–984, 1993. 80 [PV88] Leonard Pitt and Leslie G. Valiant. Computational limitations on learning from examples. Journal of the ACM (JACM), 35(4):965–984, 1988. 231 [PV05] F. Parvaresh and A. Vardy. Correcting errors beyond the Guruswami-Sudan radius in polynomial time. In Foundations of Computer Science, 2005. FOCS 2005. 46th Annual IEEE Symposium on, pages 285–294. IEEE, 2005. 121, 273 [PV15] Christos H Papadimitriou and Santosh S Vempala. Cortical learning via prediction. In Conference on Learning Theory, pages 1402–1422, 2015. 287 [PW85] Jeff Paris and Alex Wilkie. Counting problems in bounded arithmetic. In Methods in mathematical logic, pages 317–340. Springer, 1985. 73 [PW11] Chris Peikert and Brent Waters. Lossy trapdoor functions and their applications. SIAM Journal on Computing, 40(6):1803–1844, 2011. 59 [PZ89] M. Pohst and H. Zassenhaus. Algorithmic algebraic number theory. Cambridge University Press, 1989. 169 [Rab63] Michael O. Rabin. Probabilistic automata. Information and control, 6(3):230–245, 1963. 183 [Rab67] M. O. Rabin. Mathematical theory of automata. Mathematical Aspects of Computer Science, Proc. Sympos. Appl. Math. 19, Amer. Math. Soc., Providence, R.I., pages 153–175, 1967. 26 [Rab79] Michael O. Rabin. Digitalized signatures and public-key functions as intractable as factorization. Technical report, DTIC Document, 1979. 238

358 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Rab80] M. O. Rabin. Probabilistic algorithm for testing primality. Journal of number theory, 12(1):128–138, 1980. 88, 106, 157 [Rab05] Michael O. Rabin. How to exchange secrets with oblivious transfer. IACR Cryptology ePrint Archive, 2005:187, 2005. 246 [RAD78] Ronald L. Rivest, Len Adleman, and Michael L. Dertouzos. On data banks and privacy homomorphisms. Foundations of secure computation, 4(11):169–180, 1978. 247 [Rag08] P. Raghavendra. Optimal algorithms and inapproximability results for every CSP? In Proceedings of the fortieth annual ACM symposium on Theory of computing, pages 245–254. ACM, 2008. 54, 55, 272 [Ram30] F. P. Ramsey. On a problem of formal logic. Proceedings of the London Mathematical Society, 30:264–286, 1930. 100 [Raz74] Ju. P. Razmyslov. Trace identities of full matrix algebras over a ﬁeld of characteristic zero. Mathematics of the USSR-Izvestiya, 8(4):727, 1974. 174 [Raz85a] A. A. Razborov. Lower bounds for the monotone complexity of some Boolean functions. Dokl. Akad. Nauk SSSR, 281(4):798–801, 1985. English transl. Soviet Math. Doklady 31 (1985), 354–357. 68 [Raz85b] A. A. Razborov. Lower bounds on monotone complexity of the logical permanent. Matematicheskie Zametki, 37(6):887–900, 1985. 68 [Raz92] Alexander A. Razborov. On the distributional complexity of disjointness. Theoretical Computer Science, 106(2):385–390, 1992. 187, 188 [Raz95a] A. A. Razborov. Unprovability of lower bounds on the circuit size in certain fragments of bounded arithmetic. Izvestiya of the Russian Academy of Science, mathematics, 59(1):201–224, 1995. 70, 84 [Raz95b] Alexander A. Razborov. Bounded arithmetic and lower bounds in Boolean complexity. In Feasible Mathematics II, pages 344–386. Springer, 1995. 84 [Raz96] Alexander A Razborov. Lower bounds for prepositional proofs and independence results in bounded arithmetic. In Automata, Languages and Programming, pages 48–62. Springer, 1996. 84 [Raz98a] Ran Raz. A parallel repetition theorem. SIAM Journal on Computing, 27(3):763–803, 1998. 169 [Raz98b] A. A. Razborov. Lower bounds for the polynomial calculus. Comput. Complexity, 7(4):291–324, 1998. 77, 78 [Raz04a] R. Raz. Resolution lower bounds for the weak pigeonhole principle. J. ACM, 51(2):115–138, 2004. 85, 154 [Raz04b] A. A. Razborov. Resolution lower bounds for perfect matching principles. J. Comput. System Sci., 69(1):3–27, 2004. 85

359 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Raz11] Ran Raz. A counterexample to strong parallel repetition. SIAM Journal on Com- puting, 40(3):771–777, 2011. 169 [Reg09] Oded Regev. On lattices, learning with errors, random linear codes, and cryptography. Journal of the ACM (JACM), 56(6):34, 2009. 248 [Rei08] Omer Reingold. Undirected connectivity in log-space. Journal of the ACM (JACM), 55(4):17, 2008. 98, 112, 179 [RM99] R. Raz and P. McKenzie. Separation of the monotone NC hierarchy. Combinatorica, 19(3):403–435, 1999. 69 [Ros58] Frank Rosenblatt. The perceptron: a probabilistic model for information storage and organization in the brain. Psychological review, 65(6):386, 1958. 215 [Ros97] Arnold Rosenbloom. Monotone real circuits are more powerful than monotone Boolean circuits. Information Processing Letters, 61(3):161–164, 1997. 80 [Rot53] K. F. Roth. On certain sets of integers. Journal of the London Mathematical Society, 1(1):104–109, 1953. 114 [Rot06] R. Roth. Introduction to Coding Theory. Cambridge University Press, 2006. 102 [Rot14] Thomas Rothvoß. The matching polytope has exponential extension complexity. In Proceedings of the 46th annual ACM symposium on theory of computing, pages 263– 272. ACM, 2014. 197 [Rou16] Tim Roughgarden. Communication complexity (for algorithm designers). Founda- tions and Trends in Theoretical Computer Science, 11(3–4):217–404, 2016. 185, 188 [RPW04] Paul WK Rothemund, Nick Papadakis, and Erik Winfree. Algorithmic self-assembly of dna sierpinski triangles. PLoS biology, 2(12):e424, 2004. 284 [RR97] A. A. Razborov and S. Rudich. Natural proofs. J. Comput. System Sci., 55(1):24–35, 1997. 70, 105, 280 [RS59] Michael O Rabin and Dana Scott. Finite automata and their decision problems. IBM journal of research and development, 3(2):114–125, 1959. 182 [RS95] N. Robertson and P. Seymour. Graph minors I–XIII. J. Combin. Theory B, 1983– 1995. 30 [RS97] Ran Raz and Shmuel Safra. A sub-constant error-probability low-degree test, and a sub-constant error-probability PCP characterization of NP. In Proceedings of the twenty-ninth annual ACM symposium on Theory of computing, pages 475–484. ACM, 1997. 274 [RS06] V. R¨odland J. Skokan. Applications of the regularity lemma for uniform hypergraphs. Random Structures & Algorithms, 28(2):180–194, 2006. 116 [RSA78] Ronald L. Rivest, Adi Shamir, and Leonard Adleman. A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM, 21(2):120– 126, 1978. 238

360 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[RSD16] Oded Regev and Noah Stephens-Davidowitz. A reverse Minkowski theorem. arXiv preprint arXiv:1611.05979, 2016. 170 [RSW04] Eyal Rozenman, Aner Shalev, and Avi Wigderson. A new family of Cayley expanders (?). In Proceedings of the thirty-sixth annual ACM symposium on Theory of computing, pages 445–454. ACM, 2004. 112 [RT02] Tim Roughgarden and Eva´ Tardos. How bad is selﬁsh routing? Journal of the ACM (JACM), 49(2):236–259, 2002. 291 [RTS00] J. Radhakrishnan and A. Ta-Shma. Bounds for dispersers, extractors, and depth-two superconcentrators. SIAM Journal on Discrete Mathematics, 13(1):2–24, 2000. 120 [RTTV08] O. Reingold, L. Trevisan, M. Tulsiani, and S. Vadhan. Dense subsets of pseudorandom sets. In Foundations of Computer Science, 2008. FOCS’08. 49th Annual IEEE Conference on. IEEE, 2008. 115 [RTV06] Omer Reingold, Luca Trevisan, and Salil Vadhan. Pseudorandom walks on regular digraphs and the RL vs. L problem. In Proceedings of the thirty-eighth annual ACM symposium on Theory of computing, pages 457–466. ACM, 2006. 179 [RU01] Thomas J Richardson and R¨udigerL Urbanke. The capacity of low-density parity- check codes under message-passing decoding. IEEE Transactions on information theory, 47(2):599–618, 2001. 274 [RVW02] O. Reingold, S. Vadhan, and A. Wigderson. Entropy waves, the zig-zag graph product, and new constant-degree expanders. Annals of Mathematics, pages 157–187, 2002. 112, 162 [RW89] Ran Raz and Avi Wigderson. Probabilistic communication complexity of boolean relations. In Foundations of Computer Science, 1989., 30th Annual Symposium on, pages 562–567. IEEE, 1989. 192 [RW92] R. Raz and A. Wigderson. Monotone circuits for matching require linear depth. J. ACM, 39:736–744, 1992. 68, 69, 191, 192 [RW00] S. Rudich and A. Wigderson, editors. Computational Complexity Theory, volume 10. IAS/Park-City Math. Ser., Institute for Advanced Studies/Amer. Math. Soc., 2000. 71, 123 [Rys63] H. J. Ryser. Combinatorial mathematics. Math. Assoc. America, 1963. Carus Math- ematical Monographs, No. 14. 150 [SA90] H. D. Sherali and W. P. Adams. A hierarchy of relaxations between the continuous and convex hull representations for zero-one programming problems. SIAM Journal on Discrete Mathematics, 3(3):411–430, 1990. 80 [San09] R. Santhanam. Circuit lower bounds for Merlin-Arthur classes. SIAM Journal on Computing, 39(3):1038–1061, 2009. 62, 70 [Sar90] P. Sarnak. Some applications of modular forms, volume 99. Cambridge University Press, 1990. 110

361 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Sau72] Norbert Sauer. On the density of families of sets. Journal of Combinatorial Theory, Series A, 13(1):145–147, 1972. 225 [Sav70] Walter J. Savitch. Relationships between nondeterministic and deterministic tape complexities. Journal of computer and system sciences, 4(2):177–192, 1970. 127, 178, 179

[Sch78] T. J. Schaefer. The complexity of satisﬁability problems. In Proceedings of the tenth annual ACM symposium on Theory of computing, pages 216–226. ACM, 1978. 53 [Sch80] J. T. Schwartz. Fast probabilistic algorithms for veriﬁcation of polynomial identities. J. ACM, 27(4):701–717, 1980. 86

[Sch90] Robert E Schapire. The strength of weak learnability. Machine learning, 5(2):197– 227, 1990. 227, 228, 229 [Sch92] Leonard J. Schulman. Communication on noisy channels: A coding theorem for computation. In Foundations of Computer Science, 1992. Proceedings., 33rd Annual Symposium on, pages 724–733. IEEE, 1992. 203, 296

[Sch93] Leonard J. Schulman. Deterministic coding for interactive communication. In Pro- ceedings of the twenty-ﬁfth annual ACM symposium on Theory of computing, pages 747–756. ACM, 1993. 203, 296 [Sch96] Leonard J. Schulman. Coding for interactive communication. IEEE Transactions on Information Theory, 42(6):1745–1756, 1996. 203, 204

[Sch03] A. Schrijver. Combinatorial optimization. polyhedra and eﬃciency. Algorithms Com- bin., Springer-Verlag, Berlin, 2003. 28 [Sch08] G. Schoenebeck. Linear level lasserre lower bounds for certain k-CSPs. In Foundations of Computer Science, 2008. FOCS’08. IEEE 49th Annual IEEE Symposium on, pages 593–602. IEEE, 2008. 81 [See04] Nadrian C Seeman. Nanotechnology and the double helix. Scientiﬁc American, 290(6):64–75, 2004. 284 [Seg07] Nathan Segerlind. The complexity of propositional proofs. Bulletin of symbolic Logic, 13(04):417–481, 2007. 71

[Sel65] A. Selberg. On the estimation of Fourier coeﬃcients of modular forms. In Proc. Sympos. Pure Math, volume 8, pages 1–15, 1965. 111 [Ser03] Akos´ Seress. Permutation group algorithms, volume 152. Cambridge University Press, 2003. 163

[SF12] Robert E. Schapire and Yoav Freund. Boosting: Foundations and Algorithms. The MIT Press, 2012. 228 [Sha48] C. E. Shannon. A mathematical theory of communication. Bell System Technical Journal, 27(3):379–423, 1948. 100, 102, 198, 199, 200, 202, 203, 296

362 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Sha49a] C. E. Shannon. The synthesis of two-terminal switching circuits. Bell System Tech- nical Journal, 28(1):59–98, 1949. 64 [Sha49b] Claude E. Shannon. Communication theory of secrecy systems. Bell system technical journal, 28(4):656–715, 1949. 234, 238

[Sha79a] Adi Shamir. Factoring numbers in O(log n) arithmetic steps. Information Processing Letters, 8(1):28–31, 1979. 144 [Sha79b] Adi Shamir. How to share a secret. Communications of the ACM, 22(11):612–613, 1979. 246 [Sha83] Adi Shamir. On the generation of cryptographically strong pseudorandom sequences. ACM Transactions on Computer Systems (TOCS), 1(1):38–44, 1983. 94 [Sha92] Adi Shamir. IP = PSPACE. J. ACM, 39:869–877, 1992. 50, 125, 296 [Sha99] Yehuda Shalom. Bounded generation and Kazhdan’s property (T ). Publications Math´ematiquesde l’IHES´ , 90:145–168, 1999. 112

[Sha04] R. Shaltiel. Recent developments in explicit constructions of extractors. Current Trends in Theoretical Computer Science: The Challenge of the New Century, 1:229– 264, 2004. 117 [She72] Saharon Shelah. A combinatorial problem; stability and order for models and theories in inﬁnitary languages. Paciﬁc Journal of Mathematics, 41(1):247–261, 1972. 225

[She14] Alexander A. Sherstov. Communication complexity theory: Thirty-ﬁve years of set disjointness. In International Symposium on Mathematical Foundations of Computer Science, pages 24–43. Springer, 2014. 185 [Sho88] N. Z. Shor. An approach to obtaining global extremums in polynomial mathematical programming problems. Cybernetics, 23(5):695–700, 1988. 80 [Sho94] P. W. Shor. Algorithms for quantum computation: discrete logarithms and factoring. In Foundations of Computer Science, 1994 Proceedings., 35th Annual Symposium on, pages 124–134. IEEE, 1994. 134, 158, 171 [Sho95] Peter W. Shor. Scheme for reducing decoherence in quantum computer memory. Physical review A, 52(4):R2493, 1995. 136 [Sim57] Herbert A Simon. Models of man; social and rational. 1957. 283 [Sim70] Charles C. Sims. Computational methods in the study of permutation groups. In Computational problems in abstract algebra, pages 169–183, 1970. 30

[Sim97] D. R. Simon. On the power of quantum computation. SIAM Journal on Computing, 26(5):1474–1483, 1997. 134 [Sim10] D. Simon. Selected applications of LLL in number theory. In The LLL Algorithm, pages 265–282. Springer, 2010. 170

363 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Sin11] Simon Singh. The code book: the science of secrecy from ancient Egypt to quantum cryptography. Anchor, 2011. 233 [Sip88] M. Sipser. Expanders, randomness, or time versus space. Journal of Computer and System Sciences, 36(3):379–383, 1988. 118, 120

[Sip92] M. Sipser. The history and status of the P versus NP question. Proceedings of the 24th annual ACM Symposium on Theory of Computing, ACM Press, New York, pages 603–618, 1992. 33 [Sip97] M. Sipser. Introduction to the Theory of Computation. PWS Publishing Co., Boston, MA, 1997. 182

[SJ89] Alistair Sinclair and Mark Jerrum. Approximate counting, uniform generation and rapidly mixing markov chains. Information and Computation, 82(1):93–133, 1989. 110, 165, 276 [SK14] S. Saraf and M. Kumar. On the power of homogeneous depth 4 arithmetic circuits. http://www.math.rutgers.edu/~ss1984/, 2014. 154 [Sly10] Allan Sly. Computational transition at the uniqueness threshold. In Foundations of Computer Science (FOCS), 2010 51st Annual IEEE Symposium on, pages 287–296. IEEE, 2010. 166, 276 [Spe28] Emanuel Sperner. Neuer beweis fürdie invarianz der dimensionszahl und des gebi- etes. In Abhandlungen aus dem Mathematischen Seminar der Universität Hamburg, volume 6, pages 265–272. Springer, 1928. 262 [Spi71] Philip M Spira. On time-hardware complexity tradeoffs for boolean functions. In Proceedings of the 4th Hawaii Symposium on System Sciences, pages 525–527, 1971. 191

[Spi95] Daniel A. Spielman. Linear-time encodable and decodable error-correcting codes. In Proceedings of the twenty-seventh annual ACM symposium on Theory of computing, pages 388–397. ACM, 1995. 203, 274 [SS71] A. Sch¨onhageand V. Strassen. Schnelle Multiplikation grosser Zahlen. Computing, 7:281– 292, 1971. 65

[SS77] R. M. Solovay and V. Strassen. A fast Monte-Carlo test for primality. SIAM J. Comput., 6(1):84–85, 1977. 88, 106, 157 [SS79] Eli Shamir and Mark Snir. On the depth complexity of formulas. Mathematical Systems Theory, 13(1):301–322, 1979. 153

[SS96] Michael Sipser and Daniel A Spielman. Expander codes. IEEE Transactions on Information Theory, 42(6):1710–1722, 1996. 274 [SS12] D. A. Spielman and N. Srivastava. An elementary proof of the restricted invertibility theorem. Israel Journal of Mathematics, 190(1):83–91, 2012. 160

364 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[ST85] Daniel D. Sleator and Robert E. Tarjan. Amortized efficiency of list update and paging rules. Communications of the ACM, 28(2):202–208, 1985. 206, 208 [ST04a] Daniel A Spielman and Shang-Hua Teng. Nearly-linear time algorithms for graph partitioning, graph sparsification, and solving linear systems. In Proceedings of the thirty-sixth annual ACM symposium on Theory of computing, pages 81–90. ACM, 2004. 273 [ST04b] Daniel A Spielman and Shang-Hua Teng. Smoothed analysis of algorithms: Why the simplex algorithm usually takes polynomial time. Journal of the ACM (JACM), 51(3):385–463, 2004. 55, 273, 301 [ST11] D. A. Spielman and S. Teng. Spectral sparsification of graphs. SIAM Journal on Computing, 40(4):981–1025, 2011. 160 [Ste74] G. Stengle. A Nullstellensatz and a Positivstellensatz in semialgebraic geometry. Mathematische Annalen, 207(2):87–97, 1974. 80 [STJ83] E. Szemerédiand W. T. Trotter Jr. Extremal problems in discrete geometry. Com- binatorica, 3(3-4):381–392, 1983. 159 [Sto73] Larry Stockmeyer. Planar 3-colorability is polynomial complete. ACM Sigact News, 5(3):19–25, 1973. 43, 44 [Sto76] Larry J Stockmeyer. The polynomial-time hierarchy. Theoretical Computer Science, 3(1):1–22, 1976. 49, 50

[Sto10] J. Stothers. On the Complexity of Matrix Multiplication. PhD thesis, University of Edinburgh, 2010. Available at http://www.maths.ed.ac.uk/pg/thesis/stothers. pdf. 149 [Str69] V. Strassen. Gaussian elimination is not optimal. Numerische Mathematik, 13(4):354– 356, 1969. 148 [Str73a] V. Strassen. Die Berechnungskomplexitätvon elementarsymmetrischen Funktionen und von Interpolationskoeffizienten. Numerische Mathematik, 20(3):238–251, 1973. 147 [Str73b] V. Strassen. Vermeidung von Divisionen. Journal fürdie reine und angewandte Mathematik, 264:184–202, 1973. 148, 150 [Str86] V Strassen. The work of Leslie G. Valiant. In International Congress of Mathemati- cians, page 16, 1986. 47 [Str87] Volker Strassen. Relative bilinear complexity and matrix multiplication. Journal für die reine und angewandte Mathematik, 375:406–443, 1987. 173 [Stu08] Bernd Sturmfels. Algorithms in invariant theory. Springer Science & Business Media, 2008. 171

365 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[STV99] Madhu Sudan, Luca Trevisan, and Salil Vadhan. Pseudorandom generators without the xor lemma. In Proceedings of the thirty-ﬁrst annual ACM symposium on Theory of computing, pages 537–546. ACM, 1999. 273 [Sub61] B. A. Subbotovskaya. Realizations of linear functions by formulas using +, ·, −. Dok- lady Akademii Nauk SSSR, 136(3):553–555, 1961. 65

[Sud96] M. Sudan. Eﬃcient Checking of Polynomials and Proofs and the Hardness of Ap- proximation Problems. Springer-Verlag, Berlin, 1996. ACM Distinguished Theses, Lecture Notes in Comput. Sci. 1001. 130 [Sud97] Madhu Sudan. Decoding of reed-solomon codes beyond the error-correction bound. Journal of complexity, 13(1):180–193, 1997. 273 [Sud00] Madhu Sudan. List decoding: Algorithms and applications. Theoretical Computer Science: Exploring New Frontiers of Theoretical Informatics, pages 25–41, 2000. 273 [SVdB01] Aidan Schoﬁeld and Michel Van den Bergh. Semi-invariants of quivers for arbitrary dimension vectors. Indagationes Mathematicae, 12(1):125–138, 2001. 175

[SW73] David Slepian and Jack Wolf. Noiseless coding of correlated information sources. IEEE Transactions on information Theory, 19(4):471–480, 1973. 200, 201 [SW01] A. Shpilka and A. Wigderson. Depth-3 arithmetic circuits over ﬁelds of characteristic zero. Computational Complexity, 10(1):1–27, 2001. 147

[SW14] Amit Sahai and Brent Waters. How to use indistinguishability obfuscation: deniable encryption, and more. In Proceedings of the 46th Annual ACM Symposium on Theory of Computing, pages 475–484. ACM, 2014. 250 [Swa86] E. R. Swart. P=NP. Report No. CIS86-02, Department of Computer and Information Science, University of Guelph, Ontario, Canada, 1986. 194

[SY10] A. Shpilka and A. Yehudayoﬀ. Arithmetic circuits: A survey of recent results and open questions. Foundations and Trends in Theoretical Computer Science, 5(3–4):207–388, 2010. 86, 144, 153, 155

3/2 [SZ99] Michael Saks and Shiyu Zhou. BPH SP ACE(S) ⊆ DSP ACE(S ). Journal of Computer and System Sciences, 58(2):376–403, 1999. 179 [SZ00] Michael Saks and Fotios Zaharoglou. Wait-free k-set agreement is impossible: The topology of public knowledge. SIAM Journal on Computing, 29(5):1449–1483, 2000. 261, 263 [Sze88] R´obert Szelepcs´enyi. The method of forced enumeration for nondeterministic automata. Acta Informatica, 26(3):279–284, 1988. 179 [Sze12] B. Szegedy. On higher order Fourier analysis. arXiv preprint arXiv:1203.2260, 2012. 116

366 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Tal14] Avishay Tal. Shrinkage of de Morgan formulae by spectral techniques. In Foundations of Computer Science (FOCS), 2014 IEEE 55th Annual Symposium on, pages 551– 560. IEEE, 2014. 67 [Tan84] R Michael Tanner. Explicit concentrators from generalized N-gons. SIAM Journal on Algebraic Discrete Methods, 5(3):287–293, 1984. 110

[Tao07a] T. Tao. The dichotomy between structure and randomness, arithmetic progressions, and the primes. ICM 2006 Proceedings, 2007. 113 [Tao07b] T. Tao. Simons lecture I: Structure and randomness in Fourier analysis and number theory, 2007. http://terrytao.wordpress.com/2007/04/05/ simons-lecture-i-structure-and-randomness-in-fourier-analysis-and-number-theory. 113 [Tao07c] T. Tao. Simons lecture II: Structure and randomness in ergodic theory and graph theory, 2007. http://terrytao.wordpress.com/2007/04/07/ simons-lecture-ii-structure-and-randomness-in-ergodic-theory-and-graph-theory. 113

[Tao07d] T. Tao. Simons lecture III: Structure and randomness in PDE, 2007. http://terrytao.wordpress.com/2007/04/08/ simons-lecture-iii-structure-and-randomness-in-pde. 113 [Tao09] T. Tao. Recent progress on the Kakeya conjecture, 2009. http://terrytao. wordpress.com/2009/05/11/recent-progress-on-the-kakeya-conjecture. 158 [Tar51] A. Tarski. A decision method for elementary algebra and geometry. University of California Press, 1951. 22 [Tar87] E. Tardos. The gap between monotone and non-monotone circuit complexity is exponential. Combinatorica, 7(4):141–142, 1987. 68

[Tav13] S. Tavenas. Improved bounds for reduction to depth 4 and depth 3. In Mathematical Foundations of Computer Science 2013, pages 813–824. Springer, 2013. 154 [Tho87] William Sir Thomson. On the division of space with minimum partitional area. Acta mathematica, 11(1-4):121–134, 1887. 168

[Tho79] Clark D. Thompson. Area-time complexity for VLSI. In Proceedings of the eleventh annual ACM symposium on Theory of computing, pages 81–88. ACM, 1979. 189 [Tho80] Clark David Thompson. A complexity theory for VLSI. PhD thesis, Carnegie-Mellon University, 1980. 189

[Tho87] A. Thomason. Pseudo-random graphs. North-Holland Mathematics Studies, 144:307– 331, 1987. 108 [TKRR13] Yael Tauman Kalai, Ran Raz, and Ron D. Rothblum. Delegation for bounded space. In Proceedings of the forty-ﬁfth annual ACM symposium on Theory of computing, pages 565–574. ACM, 2013. 248

367 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Tod91] Seinosuke Toda. PP is as hard as the polynomial-time hierarchy. SIAM Journal on Computing, 20(5):865–877, 1991. 49, 127 [TPC15] Ashutosh Tiwari, Hirak K Patra, and Jeong-Woo Choi. Advanced theranostic materials. John Wiley & Sons, 2015. 285 [Tra84] Boris A Trakhtenbrot. A survey of Russian approaches to perebor (brute-force searches) algorithms. Annals of the History of Computing, 6(4):384–400, 1984. 33 [Tre99] L. Trevisan. Construction of extractors using pseudo-random generators. In Pro- ceedings of the thirty-ﬁrst annual ACM symposium on Theory of computing, pages 141–148. ACM, 1999. 98, 121, 247 [Tsi93] B. Tsirelson. Quantum Bell-type inequalities. Hadronic Journal Supplement, 8:329– 345, 1993. 142 [TT94] P. Tiwari and M. Tompa. A direct version of Shamir and Snir’s lower bounds on monotone circuit depth. Information Processing Letters, 49(5):243–248, 1994. 153 [TTV09] L. Trevisan, M. Tulsiani, and S. Vadhan. Regularity, boosting, and eﬃciently simulating every high-entropy distribution. In Computational Complexity, 2009. CCC’09. 24th Annual IEEE Conference on, pages 126–136. IEEE, 2009. 115 [Tur36] Alan Mathison Turing. On computable numbers, with an application to the Entschei- dungsproblem. J. of Math, 58(345-363):5, 1936. 10, 21 [Tur50] Alan M Turing. Computing machinery and intelligence. Mind, 59(236):433–460, 1950. 294 [Tur52] Alan M Turing. The chemical basis of morphogenesis. Philosophical Transactions of the Royal Society of London. Series B, Biological Sciences, 237(641):37–72, 1952. 282 [TZ08] T. Tao and T. Ziegler. The primes contain arbitrarily long polynomial progressions. Acta Mathematica, 201(2):213–305, 2008. 115 [Vad11] S. P. Vadhan. Pseudorandomness. Foundations and Trends in Theoretical Computer Science, 7(1–3):1–336, 2011. 86, 94, 117, 122, 159

[Vad16] Salil Vadhan. The complexity of diﬀerential privacy. 2016. http://privacytools. seas.harvard.edu/publications/complexity-differential-privacy. 233 [Val79a] Leslie G. Valiant. Completeness classes in algebra. Proceedings of the eleventh annual ACM Symposium on Theory of Computing, pages 249–261, 1979. 49, 151, 152 [Val79b] Leslie G. Valiant. The complexity of computing the permanent. Theoretical computer science, 8(2):189–201, 1979. 165, 173, 275 [Val79c] Leslie G. Valiant. The complexity of enumeration and reliability problems. SIAM Journal on Computing, 8(3):410–421, 1979. 49, 275 [Val80] Leslie G. Valiant. Negation can be exponentially powerful. Theoretical Computer Science, 12(3):303–314, 1980. 154

368 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Val84a] Leslie G. Valiant. Short monotone formulae for the majority function. Journal of Algorithms, 5(3):363–366, 1984. 69, 229 [Val84b] Leslie G Valiant. A theory of the learnable. Communications of the ACM, 27(11):1134–1142, 1984. 221, 223, 225

[Val00] Leslie G Valiant. Circuits of the Mind. Oxford University Press on Demand, 2000. 48, 287 [Val06] Leslie G Valiant. A quantitative theory of neural computation. Biological cybernetics, 95(3):205–211, 2006. 287 [Val09] Leslie G Valiant. Evolvability. Journal of the ACM (JACM), 56(1):3, 2009. 285

[Val12] Leslie G Valiant. The hippocampus as a stable memory allocator for cortex. Neural computation, 24(11):2873–2899, 2012. 287 [Val13] Leslie Valiant. Probably Approximately Correct: Nature’s Algorithms for Learning and Prospering in a Complex World. Basic Books, 2013. 48, 222, 285

[Val14] Leslie G Valiant. What must a global theory of cortex explain? Current opinion in neurobiology, 25:15–19, 2014. 287 [Vap98] Vladimir Vapnik. Statistical learning theory, volume 1. Wiley New York, 1998. 221 [Vap13] Vladimir Vapnik. The nature of statistical learning theory. Springer Science & Busi- ness Media, 2013. 221 [Var57] R. R. Varshamov. Estimate of the number of signals in error correcting codes. In Dokl. Akad. Nauk SSSR, volume 117, pages 739–741, 1957. In Russian. English Translation in I. F. Blake, Algebraic Coding Theory: History and Development, Dowden, Hutchinson and Ross, 1973, pp. 68–71. 101, 203

[Vav09] Stephen A. Vavasis. On the complexity of nonnegative matrix factorization. SIAM Journal on Optimization, 20(3):1364–1377, 2009. 196 [VC74] Vladimir N. Vapnik and Alexey J. Chervonenkis. Theory of pattern recognition. 1974. 221

[VC15] Vladimir N. Vapnik and A. Ya. Chervonenkis. On the uniform convergence of relative frequencies of events to their probabilities. In Measures of Complexity, pages 11–30. Springer, 2015. 221, 223, 224, 225 [Vem05] Santosh Vempala. Geometric random walks: a survey. Combinatorial and computational geometry, 52(573–612):2, 2005. 166

[Vin04] N. V. Vinodchandran. AMexp 6⊆ (NP∩coNP)/poly. Inform. Process. Lett., 89:43–47, 2004. 62, 70 [Vio15] Emanuele Viola. The communication complexity of addition. Combinatorica, 35(6):703–747, 2015. 187, 188

369 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[vN28] J. von Neumann. Zur theorie der gesellschaftsspiele. Mathematische Annalen, 100(1):295–320, 1928. 188 [vN51] J. von Neumann. Various techniques used in connection with random digits. Applied Math Series, 12(36-38):1, 1951. 94

[VN58] John Von Neumann. The computer and the brain. Yale University Press, 1958. Reprinted in 2012 with a forward by Ray Kurzweil. 282, 287 [VNB+66] John Von Neumann, Arthur W Burks, et al. Theory of self-reproducing automata. IEEE Transactions on Neural Networks, 5(1):3–14, 1966. 282 [VSBR83] Leslie G. Valiant, S. Skyum, S. Berkowitz, and C. Rackoﬀ. Fast parallel computation of polynomials using few processors. SIAM Journal on Computing, 12(4):641–644, 1983. 146 [vzGG13] J. von zur Gathen and J. Gerhard. Modern computer algebra. Cambridge university press, 2013. 144

[Wei49] A. Weil. Numbers of solutions of equations in ﬁnite ﬁelds. Bull. Amer. Math. Soc, 55(5):497–508, 1949. 102, 104 [Wei06] Dror Weitz. Counting independent sets up to the tree threshold. In Proceedings of the thirty-eighth annual ACM symposium on Theory of computing, pages 140–149. ACM, 2006. 166, 276

[Wer74] Paul Werbos. Beyond regression: New tools for prediction and analysis in the behavioral sciences. 1974. 147 [Wer94] Paul John Werbos. The roots of backpropagation: from ordered derivatives to neural networks and political forecasting, volume 1. John Wiley & Sons, 1994. 147

[Whi92] Steven R. White. Density matrix formulation for quantum renormalization groups. Physical Review Letters, 69(19):2863, 1992. 139 [Wig60] Eugene P Wigner. The unreasonable eﬀectiveness of mathematics in the natural sciences. Communications on pure and applied mathematics, 13(1):1–14, 1960. Richard courant lecture in mathematical sciences delivered at New York University, May 11, 1959. 281 [Wig93] Avi Wigderson. The fusion method for lower bounds in circuit complexity. Combi- natorics, Paul Erdos is Eighty, 1:453–468, 1993. 68 [Wig06] Avi Wigderson. P, NP and mathematics—a computational complexity perspective. In Proc. of the 2006 International Congress of Mathematicians, 2006.3

[Wig10] A. Wigderson. Expander graphs—applications and combinatorial constructions. Mas- ter’s thesis, IAS, Princeton, NJ, June 14–18 2010. A 3-hour tutorial, Pseudoran- domness in Mathematical Structures Workshop. Available at http://www.math.ias. edu/~avi/TALKS/Expander_tutorial_2010.ppt. 110

370 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Wig17] A. Wigderson. Mathematics and Computation. Princeton University Press, 2017. To appear. Draft available here: https://www.math.ias.edu/avi/book. 160, 304 [Wil75] Maurice Vincent Wilkes. Time sharing computer systems. Elsevier Science Inc., 1975. 57

[Wil14] R. Williams. Nonuniform ACC circuit lower bounds. Journal of the ACM (JACM), 61(1):2, 2014. 70 [Wil15] Virginia Vassilevska Williams. Hardness of easy problems: Basing hardness on popular conjectures such as the strong exponential time hypothesis. In Proc. International Symposium on Parameterized and Exact Computation, pages 16–28, 2015. 273

[Win06] Erik Winfree. Self-healing tile sets. Nanotechnology: science and computation, pages 55–78, 2006. 285 [Wol99] T. Wolﬀ. Recent work connected with the Kakeya problem. Prospects in mathematics (Princeton, NJ, 1996), 2:129–162, 1999. 158

[Y+12] Sergey Yekhanin et al. Locally decodable codes. Foundations and Trends R in The- oretical Computer Science, 6(3):139–255, 2012. 273 [Yan91] Mihalis Yannakakis. Expressing combinatorial optimization problems by Linear Pro- grams. Journal of Computer and System Sciences, 43(3):441–466, 1991. 194, 195, 196, 272

[Yao77] Andrew Chi-Chih Yao. Probabilistic computations: Toward a uniﬁed measure of complexity. In Foundations of Computer Science, 1977., 18th Annual Symposium on, pages 222–227. IEEE, 1977. 187, 188 [Yao79] Andrew Chi-Chih Yao. Some complexity questions related to distributive computing (preliminary report). In Proceedings of the eleventh annual ACM symposium on Theory of computing, pages 209–213. ACM, 1979. 185 [Yao82a] A. C. Yao. Theory and application of trapdoor functions. Proceedings of the 23th annual IEEE Symposium on Foundations of Computer Science, IEEE Comput. Soc. Press, pages 80–91, 1982. 90, 91, 95, 239

[Yao82b] Andrew C. Yao. Protocols for secure computations. In Foundations of Computer Science, 1982. SFCS’08. 23rd Annual Symposium on, pages 160–164. IEEE, 1982. 243 [Yao86] Andrew Chi-Chih Yao. How to generate and exchange secrets. In Foundations of Computer Science, 1986., 27th Annual Symposium on, pages 162–167. IEEE, 1986. 59, 129, 242, 243, 244, 246, 292

[Yao93] A. C. Yao. Quantum circuit complexity. Proceedings of the 34th annual IEEE Sympo- sium on Foundations of Computer Science, IEEE Comput. Soc. Press, pages 352–361, 1993. 132

371 Avi Wigderson Mathematics and Computation Draft: March 27, 2018

[Zip79] R. E. Zippel. Probabilistic algorithms for sparse polynomials. Symbolic and algebraic computation (EUROSCAM ’79), Lecture Notes in Comput. Sci., Springer-Verlag, Berlin, 72:216–226, 1979. 86 [ZL78] J. Ziv and A. Lempel. Compression of individual sequences via variable-rate coding. Information Theory, IEEE Transactions on, 24(5):530–536, 1978. 117

[Zuc90] D. Zuckerman. General weak random sources. In Proceedings of the 31st Annual Symposium on Foundations of Computer Science, pages 534–543. IEEE Computer Society, 1990. 118, 121 [Zuc91] D. Zuckerman. Computing Eﬃciently Using General Weak Random Sources. PhD thesis, U. C. Berkeley, 1991. 121 [Zuc97] David Zuckerman. Randomness-optimal oblivious sampling. Random Structures and Algorithms, 11(4):345–367, 1997. 122

372